| Category | Started On | Completed On | Duration | Cuckoo Version |
|---|---|---|---|---|
| FILE | 2014-07-18 02:10:58 | 2014-07-18 02:14:28 | 210 seconds | 1.2-dev |
| Machine | Label | Manager | Started On | Shutdown On |
|---|---|---|---|---|
| machine3 | winxpmacine3 | VirtualBox | 2014-07-18 02:10:59 | 2014-07-18 02:14:28 |
File Details
| File name | sep14tax-c8.pdf | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| File size | 414252 bytes | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| File type | PDF document, version 1.6 | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| CRC32 | 2156ECCD | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| MD5 | ed83d9070fc099171ecb95f23dcf2699 | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| SHA1 | af9d884566acd70bd3a53821a96b95b1db860373 | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| SHA256 | 5a3734b7f3fd1244c27a5bb1b1538a44b687284416b581cb73aec11069185855 | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| SHA512 | 80da02cfca1b6dde45daa173bee54d02ef89765f4ab92cf5f83fcd9ee2d4a5248b6fa91c4e45599d18881d131e5c8c839c31ee69959c12a830d579e43d345414 | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Ssdeep | None | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| PEiD | None matched | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Yara | None matched | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| VirusTotal |
Permalink VirusTotal Scan Date: 2014-07-18 05:50:22 Detection Rate: 0/54 (Expand)
|
Signatures
Starts servers listening on 127.0.0.1:0, 0.0.0.0:0
Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate)
Steals private information from local Internet browsers
Installs itself for autorun at Windows startup
Screenshots
Static Analysis
Dropped Files
Network Analysis
Hosts Involved
| IP Address |
|---|
| 10.129.0.10 |
| 10.129.0.255 |
| 23.3.13.216 |
| 23.0.57.92 |
| 23.3.13.234 |
| 23.3.13.187 |
| 23.3.13.241 |
| 23.3.13.235 |
DNS Requests
| Domain | IP Address |
|---|---|
| acroipm2.adobe.com | 23.3.13.187 |
| service-updates.adobe.com | 23.0.57.92 |
| armmf.adobe.com | 23.0.57.92 |
Behavior Summary
Files
- C:\DOCUME~1
- C:\DOCUME~1\TDW
- C:\DOCUME~1\TDW\LOCALS~1
- C:\DOCUME~1\TDW\LOCALS~1\Temp
- C:\Documents and Settings\TDW\Local Settings\Temp\sep14tax-c8.pdf
- C:\Documents and Settings\TDW
- C:\Documents and Settings\TDW\Local Settings\Temp
- C:\WINDOWS\system32\KBDUS.DLL
- C:\WINDOWS
- C:\Program Files\Adobe
- C:\Program Files\Adobe\Reader 11.0\Reader
- C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx
- C:\Documents and Settings\TDW\Application Data\Adobe
- C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat
- C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0
- C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe
- C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat
- C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0
- C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Color
- C:\Documents and Settings\TDW\Application Data\Microsoft\Speech
- C:\WINDOWS\system32
- C:\Documents and Settings\TDW\Local Settings\Application Data\
- C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\
- C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\
- C:\Documents and Settings\TDW\
- C:\Documents and Settings\TDW\Local Settings\
- C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Color\ACECache11.lst
- C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\
- C:\WINDOWS\system32\rsaenh.dll
- C:\Documents and Settings\TDW\Application Data\
- C:\Documents and Settings\TDW\Application Data\Adobe\
- C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\
- C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\Security
- C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\Security\
- C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\Security\services_rdrk.dat
- C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\Security\services_rdr.dat
- C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\Security\services_rdri.dat
- C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages
- PIPE\wkssvc
- IDE#CdRomVBOX_CD-ROM_____________________________1.0_____#42562d3231303037333036372020202020202020#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
- MountPointManager
- STORAGE#Volume#1&30a96598&0&SignatureC7EDC7EDOffset7E00Length27F4DB200#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
- C:\Documents and Settings
- C:\Documents and Settings\TDW\My Documents
- C:\Documents and Settings\TDW\My Documents\desktop.ini
- C:\Documents and Settings\All Users
- C:\Documents and Settings\All Users\Documents
- C:\Documents and Settings\All Users\Documents\desktop.ini
- C:\Documents and Settings\TDW\Desktop
- C:\Documents and Settings\All Users\Desktop
- C:\WINDOWS\Registration\R000000000007.clb
- C:\Program Files\Adobe\Reader 11.0\Reader\Eula.exe
- C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0\UserCache.bin
- C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\Collab\
- C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\Collab
- C:\Documents and Settings\TDW\Application Data\desktop.ini
- C:\Documents and Settings\TDW\Application Data\Adobe\Flash Player\
- C:\Documents and Settings\TDW\Application Data\Adobe\Flash Player\AssetCache\
- C:\Documents and Settings\TDW\Application Data\Adobe\Flash Player\AssetCache\XDRSAYPT
- C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\FAP1.tmp
- C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\FAP1.tmp
- C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0\
- C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0\SharedDataEvents
- C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0\SharedDataEvents-journal
- C:\Documents and Settings\TDW\Local Settings\Temp\
- PIPE\lsarpc
- C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\
- C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\A9R40C5.tmp
- C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal
- C:\WINDOWS\system32\shell32.dll
- C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files
- C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\
- C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5
- C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\index.dat
- C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\index.dat
- C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\desktop.ini
- C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\desktop.ini
- C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\QBAUBVMU
- C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\QBAUBVMU
- C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\QBAUBVMU\desktop.ini
- C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\QBAUBVMU\desktop.ini
- C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\70171OGX
- C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\70171OGX
- C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\70171OGX\desktop.ini
- C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\70171OGX\desktop.ini
- C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\0523LVRI
- C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\0523LVRI
- C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\0523LVRI\desktop.ini
- C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\0523LVRI\desktop.ini
- C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\PK1GFI2J
- C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\PK1GFI2J
- C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\PK1GFI2J\desktop.ini
- C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\PK1GFI2J\desktop.ini
- C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Cookies\
- C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Cookies
- C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Cookies\index.dat
- C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Cookies\index.dat
- C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\History
- C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\History
- C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\History\History.IE5\
- C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\History\History.IE5
- C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\History\History.IE5\index.dat
- C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\History\History.IE5\index.dat
- C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\History\History.IE5\desktop.ini
- C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\History\History.IE5\desktop.ini
- C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\assets
- C:\Documents and Settings\TDW\Local Settings\Temporary Internet Files
- C:\Documents and Settings\TDW\Local Settings\History
- C:\Documents and Settings\TDW\Local Settings\Temporary Internet Files\Content.IE5\
- C:\
- C:\Documents and Settings\TDW\Local Settings\Temporary Internet Files\Content.IE5\index.dat
- C:\Documents and Settings\TDW\Cookies\
- C:\Documents and Settings\TDW\Cookies\index.dat
- C:\Documents and Settings\TDW\Local Settings\History\History.IE5\
- C:\Documents and Settings\TDW\Local Settings\History\History.IE5\index.dat
- C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\A9R40C6.tmp
- C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\A9R40C6.tmp
- c:\autoexec.bat
- C:\Documents and Settings\TDW\Local Settings
- C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Connections\Pbk\*.pbk
- C:\WINDOWS\system32\Ras\*.pbk
- C:\Documents and Settings\TDW\Application Data\Microsoft\Network\Connections\Pbk\*.pbk
- C:\Documents and Settings\TDW\Application Data\Microsoft\SystemCertificates\My\Certificates\*
- C:\Documents and Settings\TDW\Application Data\Microsoft\SystemCertificates\My\CRLs\*
- C:\Documents and Settings\TDW\Application Data\Microsoft\SystemCertificates\My\CTLs\*
- C:\Documents and Settings\TDW\Cookies\tdw@adobe[2].txt
Mutexes
- Global\ARM Update Mutex
- Global\Acro Update Mutex
- {100184D2-BDC3-477a-B8D3-65548B67914C}_448
- _!MSFTHISTORY!_
- c:!documents and settings!tdw!local settings!temporary internet files!content.ie5!
- c:!documents and settings!tdw!cookies!
- c:!documents and settings!tdw!local settings!history!history.ie5!
- WininetStartupMutex
- WininetConnectionMutex
- WininetProxyRegistryMutex
Registry Keys
- HKEY_LOCAL_MACHINE\Software\Policies\Adobe\Acrobat Reader\11.0\FeatureLockDown
- HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\11.0\Privileged
- HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Adobe\Acrobat Reader\11.0
- HKEY_LOCAL_MACHINE\Software\Adobe\Adobe Acrobat\11.0\Security
- HKEY_LOCAL_MACHINE\Software\Adobe\Acrobat Reader\11.0\Installer
- HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\11.0\AVGeneral\cRecentFiles\c1
- HKEY_USERS\S-1-5-21-1935655697-1606980848-1060284298-1003
- Keyboard Layout\Preload
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Objects\{20D04FE0-3AEA-1069-A2D8-08002B30309D}
- HKEY_CLASSES_ROOT\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32
- HKEY_CLASSES_ROOT\Drive\shellex\FolderExtensions
- HKEY_CLASSES_ROOT\Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9}
- HKEY_CURRENT_USER\
- HKEY_CLASSES_ROOT\
- HKEY_LOCAL_MACHINE\
- HKEY_USERS\
- HKEY_CURRENT_CONFIG\
- HKEY_CURRENT_USER\Software\Adobe\Adobe Acrobat\11.0
- HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\11.0
- HKEY_CURRENT_USER\Software\Adobe\Adobe Synchronizer\11.0
- HKEY_CURRENT_USER\Software\Adobe\CommonFiles\Usage\Reader 11
- HKEY_LOCAL_MACHINE\SOFTWARE\Justsystem\ATOK\Setup\Folder
- HKEY_LOCAL_MACHINE\System
- HKEY_LOCAL_MACHINE\System\Acrobatbrokerserverdispatchercpp789
- Software\Adobe\Acrobat Reader\11.0\Installer\Migrated
- Language
- Software\Adobe\Adobe Synchronizer\11.0
- Software\Adobe\Adobe Synchronizer\11.0\SOFTWARE\Microsoft\Cryptography\Providers\Type 001
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Strong Cryptographic Provider
- HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager
- HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\Offload
- HKEY_USERS\S-1-5-21-1935655697-1606980848-1060284298-1003\SOFTWARE\Microsoft\Cryptography\Providers\Type 001
- HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.exe
- HKEY_CLASSES_ROOT\.exe
- HKEY_CLASSES_ROOT\exefile
- HKEY_CLASSES_ROOT\exefile\CurVer
- HKEY_CLASSES_ROOT\exefile\
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
- HKEY_CLASSES_ROOT\exefile\\ShellEx\IconHandler
- HKEY_CLASSES_ROOT\SystemFileAssociations\.exe
- HKEY_CLASSES_ROOT\SystemFileAssociations\application
- HKEY_CLASSES_ROOT\exefile\\Clsid
- HKEY_CLASSES_ROOT\*
- HKEY_CLASSES_ROOT\*\Clsid
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{e6c716a0-b561-11e1-9849-806d6172696f}\
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{e6c716a2-b561-11e1-9849-806d6172696f}\
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e6c716a2-b561-11e1-9849-806d6172696f}\
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e6c716a0-b561-11e1-9849-806d6172696f}\
- HKEY_CLASSES_ROOT\Directory
- HKEY_CLASSES_ROOT\Directory\CurVer
- HKEY_CLASSES_ROOT\Directory\
- HKEY_CLASSES_ROOT\Directory\\ShellEx\IconHandler
- HKEY_CLASSES_ROOT\Directory\\Clsid
- HKEY_CLASSES_ROOT\Folder
- HKEY_CLASSES_ROOT\Folder\Clsid
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
- HKEY_CLASSES_ROOT\CLSID\{AEB6717E-7E19-11D0-97EE-00C04FD91972}\InProcServer32
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Associations
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Associations
- HKEY_CLASSES_ROOT\.ade
- HKEY_CLASSES_ROOT\.adp
- HKEY_CLASSES_ROOT\.app
- HKEY_CLASSES_ROOT\.asp
- HKEY_CLASSES_ROOT\.bas
- HKEY_CLASSES_ROOT\.bat
- HKEY_CLASSES_ROOT\.cer
- HKEY_CLASSES_ROOT\.chm
- HKEY_CLASSES_ROOT\.cmd
- HKEY_CLASSES_ROOT\.com
- HKEY_CLASSES_ROOT\.cpl
- HKEY_CLASSES_ROOT\.crt
- HKEY_CLASSES_ROOT\.csh
- HKEY_LOCAL_MACHINE\Software\Microsoft\COM3
- HKEY_USERS\S-1-5-21-1935655697-1606980848-1060284298-1003_Classes
- HKEY_LOCAL_MACHINE\Software\Classes
- \REGISTRY\USER
- HKEY_LOCAL_MACHINE\Software\Classes\CLSID
- CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}
- CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TreatAs
- \CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}
- \CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\InprocServer32
- \CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\InprocServerX86
- \CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\LocalServer32
- \CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\InprocHandler32
- \CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\InprocHandlerX86
- \CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\LocalServer
- HKEY_CLASSES_ROOT\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}
- HKEY_CLASSES_ROOT\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TreatAs
- HKEY_CLASSES_ROOT\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\InProcServer32
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\
- HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\
- HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\\Ranges\
- HKEY_LOCAL_MACHINE\System\Setup
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\\0
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\\1
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\\2
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\\3
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\\4
- HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\
- HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0
- HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0
- HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1
- HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1
- HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2
- HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2
- HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3
- HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3
- HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4
- HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4
- HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4
- HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\
- HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0
- HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0
- HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1
- HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1
- HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2
- HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2
- HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3
- HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3
- HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4
- HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4
- HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4
- HKEY_CLASSES_ROOT\PROTOCOLS\Name-Space Handler\
- HKEY_CLASSES_ROOT\PROTOCOLS\Name-Space Handler\C\
- HKEY_CLASSES_ROOT\PROTOCOLS\Name-Space Handler\*\
- HKEY_CURRENT_USER\SOFTWARE\Classes\PROTOCOLS\Handler\C
- HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\C
- HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
- HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl
- HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl
- HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl
- HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl
- HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESPECT_OBJECTSAFETY_POLICY_KB905547
- HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
- HKEY_CLASSES_ROOT\exefile\\shell\open
- HKEY_CLASSES_ROOT\exefile\\shell\open\command
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\RestrictRun
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\App Paths\Eula.exe
- HKEY_CLASSES_ROOT\exefile\\shell\open\ddeexec
- HKEY_CLASSES_ROOT\Applications\Eula.exe
- HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam
- HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache
- HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\FileAssociation
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer
- CLSID\{B801CA65-A1FC-11D0-85AD-444553540000}
- CLSID\{B801CA65-A1FC-11D0-85AD-444553540000}\TreatAs
- \CLSID\{B801CA65-A1FC-11D0-85AD-444553540000}
- \CLSID\{B801CA65-A1FC-11D0-85AD-444553540000}\InprocServer32
- \CLSID\{B801CA65-A1FC-11D0-85AD-444553540000}\InprocServerX86
- \CLSID\{B801CA65-A1FC-11D0-85AD-444553540000}\LocalServer32
- \CLSID\{B801CA65-A1FC-11D0-85AD-444553540000}\InprocHandler32
- HKEY_LOCAL_MACHINE\Software\Microsoft\Ole
- HKEY_CLASSES_ROOT\AppID\AcroRd32.exe
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE
- HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\ComputerName
- ActiveComputerName
- HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\11.0\AVGeneral
- HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\11.0\AVGeneral\cRecentFiles
- Software\Adobe\Adobe Synchronizer\11.0\CredentialsV2
- HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
- HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
- HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Cache
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\Path1
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\Path2
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\Path3
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\Path4
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Special Paths
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014071820140719
- HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_AUTOPROXY_CACHE_ANAME_KB921400
- HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_TEMPORARYFILES_FOR_NOCACHE_840387
- HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_TEMPORARYFILES_FOR_NOCACHE_840386
- HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\RETRY_HEADERONLYPOST_ONCONNECTIONRESET
- HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_CHUNK_TIMEOUT_KB914453
- HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_CERT_TRUST_VERIFIED_KB936882
- HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache
- HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache
- HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache
- HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BUFFERBREAKING_818408
- HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SKIP_POST_RETRY_ON_INTERNETWRITEFILE_KB895954
- HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ENSURE_FQDN_FOR_NEGOTIATE_KB899417
- HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_HTTP_DISABLE_NTLM_PREAUTH_IF_ABORTED_KB902409
- HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_PERMIT_CACHE_FOR_AUTHENTICATED_FTP_KB910274
- HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WPAD_STORE_URL_AS_FQDN_KB903926
- HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_USE_CNAME_FOR_SPN_KB911149
- HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_KEEP_CACHE_INDEX_OPEN_KB899342
- HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WAIT_TIME_THREAD_TERMINATE_KB886801
- HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_FIX_CHUNKED_PROXY_SCRIPT_DOWNLOAD_KB843289
- HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Http Filters\RPA
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Http Filters\RPA
- HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_INCLUDE_PORT_IN_SPN_KB908209
- HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING
- HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE
- HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing
- HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\RASAPI32
- HKEY_USERS\S-1-5-21-1935655697-1606980848-1060284298-1003\Software\Microsoft\windows\CurrentVersion\Internet Settings
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList
- HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment
- HKEY_USERS\S-1-5-21-1935655697-1606980848-1060284298-1003\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
- HKEY_USERS\S-1-5-21-1935655697-1606980848-1060284298-1003\Environment
- HKEY_USERS\S-1-5-21-1935655697-1606980848-1060284298-1003\Volatile Environment
- HKEY_USERS\S-1-5-21-1935655697-1606980848-1060284298-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
- HKEY_USERS\S-1-5-21-1935655697-1606980848-1060284298-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
- HKEY_USERS\S-1-5-21-1935655697-1606980848-1060284298-1003\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections
- HKEY_CURRENT_CONFIG\Software\Microsoft\windows\CurrentVersion\Internet Settings
- HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\OID
- HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\OID\EncodingType 0
- HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\OID\EncodingType 0\CertDllOpenStoreProv
- HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\OID\EncodingType 0\CertDllOpenStoreProv\#16
- HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\OID\EncodingType 0\CertDllOpenStoreProv\Ldap
- HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\OID\EncodingType 1
- HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\OID\EncodingType 1\CertDllOpenStoreProv
- HKEY_USERS\S-1-5-21-1935655697-1606980848-1060284298-1003\Software\Microsoft\SystemCertificates\MY\PhysicalStores
- HKEY_USERS\S-1-5-21-1935655697-1606980848-1060284298-1003\Software\Microsoft\SystemCertificates\MY
- HKEY_USERS\S-1-5-21-1935655697-1606980848-1060284298-1003\Software\Microsoft\SystemCertificates\MY\
- HKEY_USERS\S-1-5-21-1935655697-1606980848-1060284298-1003\Software\Microsoft\SystemCertificates\MY\\Certificates
- HKEY_USERS\S-1-5-21-1935655697-1606980848-1060284298-1003\Software\Microsoft\SystemCertificates\MY\\CRLs
- HKEY_USERS\S-1-5-21-1935655697-1606980848-1060284298-1003\Software\Microsoft\SystemCertificates\MY\\CTLs
- HKEY_USERS\S-1-5-21-1935655697-1606980848-1060284298-1003\Software\Microsoft\SystemCertificates\MY\\Keys
- HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_VALIDATE_URLHOSTNAME
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\\Domains\adobe.com
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\adobe.com
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\\ProtocolDefaults\
Processes
registry filesystem process services network synchronization
AcroRd32.exe PID: 448, Parent PID: 244
| Timestamp | Thread | Function | Arguments | Status | Return | Repeated |
|---|---|---|---|---|---|---|
| 09:18:00,815 | 452 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => KERNEL32.DLL |
SUCCESS | 0x00000000 | |
| 09:18:00,815 | 452 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => FlsAlloc FunctionAddress => 0x00522e5c ModuleHandle => 0x7c800000 |
FAILURE | 3221225785 | |
| 09:18:00,815 | 452 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => FlsGetValue FunctionAddress => 0x00522e50 ModuleHandle => 0x7c800000 |
FAILURE | 3221225785 | |
| 09:18:00,815 | 452 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => FlsSetValue FunctionAddress => 0x00522e44 ModuleHandle => 0x7c800000 |
FAILURE | 3221225785 | |
| 09:18:00,815 | 452 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => FlsFree FunctionAddress => 0x00522e3c ModuleHandle => 0x7c800000 |
FAILURE | 3221225785 | |
| 09:18:00,825 | 452 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => KERNEL32.DLL |
SUCCESS | 0x00000000 | |
| 09:18:00,885 | 452 | LdrLoadDll |
Flags => 1244460 BaseAddress => 0x7c9c0000 FileName => SHELL32.dll |
SUCCESS | 0x00000000 | |
| 09:18:00,885 | 452 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CommandLineToArgvW FunctionAddress => 0x7ca41348 ModuleHandle => 0x7c9c0000 |
SUCCESS | 0x00000000 | |
| 09:18:00,885 | 452 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:18:00,885 | 452 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => IsWow64Process FunctionAddress => 0x7c815229 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:18:00,905 | 452 | RegOpenKeyExW |
Handle => 0x00000080 Registry => 0x80000002 SubKey => Software\Policies\Adobe\Acrobat Reader\11.0\FeatureLockDown |
SUCCESS | 0x00000000 | |
| 09:18:00,905 | 452 | RegQueryValueExW |
Handle => 0x00000080 DataLength => 4 ValueName => bProtectedMode Type => 1242528 |
FAILURE | 0x00000002 | |
| 09:18:00,905 | 452 | RegCloseKey |
Handle => 0x00000080 |
SUCCESS | 0x00000000 | |
| 09:18:00,905 | 452 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Adobe\Acrobat Reader\11.0\Privileged |
FAILURE | 0x00000002 | |
| 09:18:00,905 | 452 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => sftldr.dll |
FAILURE | 3221225781 | 1 time |
| 09:18:00,905 | 452 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => sftldr_wow64.dll |
FAILURE | 3221225781 | 1 time |
| 09:18:00,915 | 452 | FindWindowA |
ClassName => 32770 WindowName => _AcroAppTimer |
FAILURE | 0x00000000 | |
| 09:18:00,915 | 452 | RegOpenKeyExW |
Handle => 0x0000008c Registry => 0x80000002 SubKey => SOFTWARE\Policies\Adobe\Acrobat Reader\11.0 |
SUCCESS | 0x00000000 | |
| 09:18:00,915 | 452 | RegQueryValueExW |
Handle => 0x0000008c DataLength => 4 ValueName => bEnableAlternateTempDirectory Type => 1244632 |
FAILURE | 0x00000002 | |
| 09:18:00,915 | 452 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Adobe\Acrobat Reader\11.0\Privileged |
FAILURE | 0x00000002 | |
| 09:18:00,915 | 452 | RegQueryValueExW |
Handle => 0x00000000 DataLength => 4 ValueName => bEnableAlternateTempDirectory Type => 4 |
FAILURE | 0x00000006 | |
| 09:18:00,915 | 452 | RegCloseKey |
Handle => 0x0000008c |
SUCCESS | 0x00000000 | |
| 09:18:00,915 | 452 | RegOpenKeyExW |
Handle => 0x0000008c Registry => 0x80000002 SubKey => SOFTWARE\Policies\Adobe\Acrobat Reader\11.0 |
SUCCESS | 0x00000000 | |
| 09:18:00,915 | 452 | RegQueryValueExW |
Handle => 0x0000008c DataLength => 4 ValueName => bEnableAlternateLaunchDesktop Type => 1244632 |
FAILURE | 0x00000002 | |
| 09:18:00,915 | 452 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Adobe\Acrobat Reader\11.0\Privileged |
FAILURE | 0x00000002 | |
| 09:18:00,915 | 452 | RegQueryValueExW |
Handle => 0x00000000 DataLength => 4 ValueName => bEnableAlternateLaunchDesktop Type => 4 |
FAILURE | 0x00000006 | |
| 09:18:00,915 | 452 | RegCloseKey |
Handle => 0x0000008c |
SUCCESS | 0x00000000 | |
| 09:18:00,915 | 452 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Adobe\Adobe Acrobat\11.0\Security |
FAILURE | 0x00000002 | |
| 09:18:00,915 | 452 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:18:00,915 | 452 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => SetProcessDEPPolicy FunctionAddress => 0x7c862144 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:18:00,915 | 452 | NtOpenMutant |
Handle => 0x7c80ae80 MutexName => Global\ARM Update Mutex |
FAILURE | 3221225524 | |
| 09:18:00,925 | 452 | NtOpenMutant |
Handle => 0x7c80ae80 MutexName => Global\Acro Update Mutex |
FAILURE | 3221225524 | |
| 09:18:00,925 | 452 | FindWindowW |
ClassName => AdobeAcrobatSpeedLaunchCmdWnd WindowName => |
FAILURE | 0x00000000 | |
| 09:18:00,925 | 452 | FindWindowW |
ClassName => AdobeReaderSpeedLaunchCmdWnd WindowName => |
FAILURE | 0x00000000 | |
| 09:18:00,955 | 452 | LdrLoadDll |
Flags => 1244448 BaseAddress => 0x77690000 FileName => NTMARTA.DLL |
SUCCESS | 0x00000000 | |
| 09:18:00,955 | 452 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => AccFreeIndexArray FunctionAddress => 0x77698632 ModuleHandle => 0x77690000 |
SUCCESS | 0x00000000 | |
| 09:18:00,955 | 452 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => AccTreeResetNamedSecurityInfo FunctionAddress => 0x77699253 ModuleHandle => 0x77690000 |
SUCCESS | 0x00000000 | |
| 09:18:00,955 | 452 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => AccGetInheritanceSource FunctionAddress => 0x77698e1d ModuleHandle => 0x77690000 |
SUCCESS | 0x00000000 | |
| 09:18:00,955 | 452 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => AccLookupAccountTrustee FunctionAddress => 0x776a6901 ModuleHandle => 0x77690000 |
SUCCESS | 0x00000000 | |
| 09:18:00,955 | 452 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => AccRewriteGetNamedRights FunctionAddress => 0x776925cd ModuleHandle => 0x77690000 |
SUCCESS | 0x00000000 | |
| 09:18:00,955 | 452 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => AccRewriteSetNamedRights FunctionAddress => 0x7769324d ModuleHandle => 0x77690000 |
SUCCESS | 0x00000000 | |
| 09:18:00,955 | 452 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => AccRewriteGetHandleRights FunctionAddress => 0x776930d1 ModuleHandle => 0x77690000 |
SUCCESS | 0x00000000 | |
| 09:18:00,955 | 452 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => AccRewriteSetHandleRights FunctionAddress => 0x77692f83 ModuleHandle => 0x77690000 |
SUCCESS | 0x00000000 | |
| 09:18:00,955 | 452 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => AccRewriteSetEntriesInAcl FunctionAddress => 0x77692a56 ModuleHandle => 0x77690000 |
SUCCESS | 0x00000000 | |
| 09:18:00,955 | 452 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => AccRewriteGetExplicitEntriesFromAcl FunctionAddress => 0x77699ec8 ModuleHandle => 0x77690000 |
SUCCESS | 0x00000000 | |
| 09:18:00,955 | 452 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => AccLookupAccountName FunctionAddress => 0x776a52d2 ModuleHandle => 0x77690000 |
SUCCESS | 0x00000000 | |
| 09:18:00,955 | 452 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => AccLookupAccountSid FunctionAddress => 0x776a64b3 ModuleHandle => 0x77690000 |
SUCCESS | 0x00000000 | |
| 09:18:00,955 | 452 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => AccSetEntriesInAList FunctionAddress => 0x776a5c9a ModuleHandle => 0x77690000 |
SUCCESS | 0x00000000 | |
| 09:18:00,955 | 452 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => AccConvertAccessToSecurityDescriptor FunctionAddress => 0x776a5d8d ModuleHandle => 0x77690000 |
SUCCESS | 0x00000000 | |
| 09:18:00,955 | 452 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => AccConvertSDToAccess FunctionAddress => 0x776a5e9c ModuleHandle => 0x77690000 |
SUCCESS | 0x00000000 | |
| 09:18:00,955 | 452 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => AccGetAccessForTrustee FunctionAddress => 0x776a6050 ModuleHandle => 0x77690000 |
SUCCESS | 0x00000000 | |
| 09:18:00,955 | 452 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => AccConvertAclToAccess FunctionAddress => 0x776a60c9 ModuleHandle => 0x77690000 |
SUCCESS | 0x00000000 | |
| 09:18:00,955 | 452 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => AccGetExplicitEntries FunctionAddress => 0x776a628b ModuleHandle => 0x77690000 |
SUCCESS | 0x00000000 | |
| 09:18:00,985 | 452 | CreateThread |
ThreadId => 0 StartRoutine => 0x0040c2a0 Parameter => 0x0039a880 CreationFlags => 0 |
SUCCESS | 0x000000d0 | |
| 09:18:00,985 | 452 | RegOpenKeyExW |
Handle => 0x000000d4 Registry => 0x80000002 SubKey => SOFTWARE\Policies\Adobe\Acrobat Reader\11.0 |
SUCCESS | 0x00000000 | |
| 09:18:00,985 | 452 | RegQueryValueExW |
Handle => 0x000000d4 DataLength => 4 ValueName => bEnableHeapMitigations Type => 1244592 |
FAILURE | 0x00000002 | |
| 09:18:00,985 | 452 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Adobe\Acrobat Reader\11.0\Privileged |
FAILURE | 0x00000002 | |
| 09:18:00,985 | 452 | RegQueryValueExW |
Handle => 0x00000000 DataLength => 4 ValueName => bEnableHeapMitigations Type => 4 |
FAILURE | 0x00000006 | |
| 09:18:00,985 | 452 | RegCloseKey |
Handle => 0x000000d4 |
SUCCESS | 0x00000000 | |
| 09:18:00,985 | 452 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:18:01,015 | 452 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => HeapAlloc FunctionAddress => 0x7c9100a4 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:18:01,015 | 452 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => HeapFree FunctionAddress => 0x7c90ff0d ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:18:01,015 | 452 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:18:01,015 | 452 | VirtualProtectEx |
Protection => 0x00000080 ProcessHandle => 0xffffffff Address => 0x004fc38c Size => 0x00000004 |
SUCCESS | 0x00000001 | |
| 09:18:01,015 | 452 | VirtualProtectEx |
Protection => 0x00000002 ProcessHandle => 0xffffffff Address => 0x004fc38c Size => 0x00000004 |
SUCCESS | 0x00000001 | |
| 09:18:01,015 | 452 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:18:01,015 | 452 | VirtualProtectEx |
Protection => 0x00000080 ProcessHandle => 0xffffffff Address => 0x004fc414 Size => 0x00000004 |
SUCCESS | 0x00000001 | |
| 09:18:01,015 | 452 | VirtualProtectEx |
Protection => 0x00000002 ProcessHandle => 0xffffffff Address => 0x004fc414 Size => 0x00000004 |
SUCCESS | 0x00000001 | |
| 09:18:01,015 | 452 | LdrLoadDll |
Flags => 1244440 BaseAddress => 0x774e0000 FileName => ole32.dll |
SUCCESS | 0x00000000 | |
| 09:18:01,025 | 452 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CoInitializeEx FunctionAddress => 0x774fef7b ModuleHandle => 0x774e0000 |
SUCCESS | 0x00000000 | |
| 09:18:01,025 | 452 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => C:\WINDOWS\system32\rpcss.dll |
FAILURE | 3221225781 | 1 time |
| 09:18:01,025 | 452 | DeviceIoControl |
DeviceHandle => 0x00000090 OutBuffer => \x1e\x015\x91\xfd\x08\x9c\x8b\xac\x02 \xdc\xe1\xff\x94\xf2\x0e\xa6{]dk\x07\xd0\xd1Y\xe6\xfd\xc8\xa7:q~\x06*\xaeA\xc0F\s\x1f\xc2\x1b\xad\xebjOZ\x82%\xc1\x9f\xb6\xcc\xa1G\xe8\xb3\xc6@V\xfc8m\x93)\x9c\xd6\xd8wC\xcaM\xdd\xe2(\xda\x1f\x90\x08\x1b-r(\x88\xf7Gk\xa632g=\xbb\xd2^\xe9\x94\xfc\xc7J`\xa6\xbe\x91(_\x8e\x97QG\xa0\x9f\xa0\x1d\xbcX\xcf\x05'\xbc\x18\x1f\xce\xa3\x9fa3\x0e\x82<\xb8}\xe1\xe8\x94\xeb\xf1\xd0\x92}\xb2\xc5?:\xa9\xa2\xb6\xbf&\xb5\x1dw\x1a6>\x1e\xea\x8b\x08\xbf\xdb\xc1)V\xa5v\xa1d#k \xfc]&<\x01v:l\xf9#Xy\x99\x03\xfd\x9cw\x82\xa4\x0f \xca\xaesBW\xab"V,\xd0\xe0=\xe8\xda\xfd\xac}\xe4?\xb9#x\xa1J\xa9\xa1\xda{~L\xb2\x84O\xbd9\xa2\xf5fz\x8c\xa14\xa9E\x0e\xfdEr\xa1u\xf9\xdcVUg:\xdeMOO\xf9\xac IoControlCode => 3735560 InBuffer => \xde\xf6\x1f\xa1Q\x0b\x97\xaf\xb0o+|D\xfe68\x14\x15nF+\x13\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000001 | |
| 09:18:01,025 | 452 | DeviceIoControl |
DeviceHandle => 0x00000090 OutBuffer => |\x88gRQ \xa6bG\xcd4\x87\xb8\xa8\xc3\xcdqJ\xe4\x1d\xc2\xcc\x95\x18\x15l.\x1aBk/|.\x93\xf9\x10\x96+\x0cC\xff\xd70\xef,u\x9d*\xdf\xea\xce#\xf0\xb8\xbf\xaf\xd42,\xc3R<N#]\xedTU#\xfc\x8fi\xa3\xe9\x163\xa22\x1f\x82\x91\xea;\xb7\x84P\xeay\x8b*\x883\x92\x95)\xc2 (R\x9c*\xd7g \x89O\xf1\xcd\x8f \xa8\xe2\xfd\x16\xdd\x86\x04u9\xf2"c\x17\x00CN\x01\x0f\xa7\xe8(U\x92Ky\xbd\xa7\xe4\xa6\x1b\xd4\x9bO\x05\x91\xb5w>\x0b\xd8\xcd^\x14\xc6\xb4\xf4\xbf\xb3\x8c\xb6\x0e\xdcq]\x8c\xed\xf4\xe8\x0b\xce\xad\x88j \x1c\xdb1%\x01\x9d\xf3S\x16\xce/!F\x8f{\xb5\x03\x8f\xb6jZ\xd6\xcc.\x92\x9f\xa2;\x8do\xba\xb7\xbc\\xd8\xb4\xfd\x8cg2F\xea\xda\xc1\x94\x85 \xf6N\x14\xb9*c\xd4\xc7\xa2\xbf\xe5j\x86\x83\xcco\xe5\x0e1\xe7\xd1\x80\xda\xbe4\x94-)D\x07\xe4\xefa\xd5\x9e IoControlCode => 3735560 InBuffer => \xde\xf6\x1f\xa1Q\x0b\x97\xaf\xb0o+|D\xfe,\xea\x92\xed\xbe\xc5a&S\x14\x15nF+\x13\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000001 | |
| 09:18:01,025 | 452 | DeviceIoControl |
DeviceHandle => 0x00000090 OutBuffer => \xe1qtp\x95+c\xaa\xc6:\xc8gcB\x86rP\x166[\x13\xbb\xb4\xacA\x16\x90\xfc'\xf9\x06s\xa9\xb8]*h\xce\x1c\x8e\xda=\xadF\xb3_\xa1\xf3\xfa\xf80?\x97o\x8a\xd0\xab} \xef\xc8\xdc NJ\ `L1\xb6\xf5C\x81\xa7O\xcf\xb0*\xa6\xa3\xf8\xac\x8f=A\xef~gm\xca\xc2NK{\xe97}6\x16\xb8t\xee\xb9LkV\xc4\xa0\x1a\xaa3\xf8\x18\xefk4\x04\xe7\xfdE\xd8\x8d)NT\xce\x7fZ_\xa4\x8a\xfe\x87[\x03Nf\x9c\x80\xe8\xb7\xc1B\xc5OB\x90y}\xb5Trs\xf2u\xa9V\xf5\x87\xf2\x89\xdbw\xb9\x84\x7f\xae\xa4P\x9e\xd4K\x0f\x07\xb6\xfdLy\xbf\x1d\xe8\xe4\x1c|j\x03\x9e\x99\xbd\xbf|QbA\xd8"\xfb2\xc5\x97J\x83\xa7;t\x10\xa4\x8f"Z\x00\x92X\xbc\x1aM\xc0\xac\xdf!+\xc1[\x93> \xf8\xe4~\x99\xac\xaf9/\x10K\xb3=\xb2k\x85$I:\xc4 \x92\xa9\x1cd\x86\x82 \x1e\xc5 IoControlCode => 3735560 InBuffer => \xde\xf6\x1f\xa1Q\x0b\x97\xaf\xb0o+|D\xfe,\xea\x92\xed\xbe\xc5a<\x81\x92\xed\xbe\xc5a&S\x14\x15nF+\x13\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000001 | |
| 09:18:01,025 | 452 | DeviceIoControl |
DeviceHandle => 0x00000090 OutBuffer => ;\x17H\x80\x9by\xb9wO\x8e\xe4\x94\xbeK<V \xd3\xa1\xdfv\xd1C\x84F\xf1\xb1\x986\x8f\x166\x01\xd5\xfc.\x1c\xa0\xc9w+2\xc9o\xfb\x8d\xb9\xbe\xa3y\x84O\xff;\x88E;\xac\xd9\x12!ww\xbe\xa8\x1a\xd43\x01d72\xac\xeey\xe6\xf2-Qx\xb7\xbej\x007\x98v\xd3z\xb0\x84\xa0ii\x07:\x0f7\x96\xdf\x8b~\x9d\xab\xd2T\xcc<65\x00ur+Go*\xd5\xa6\x8a\xb9\x15\xa7\x80\xc2\xe3y\x15\xbd\x0bZ\xe9/6\xf21\xcfd\xa7\xc2\x96w\xde"\x18\xdb\xa3\xdd\xddh\xb7\xdeA*\xe8\x00\xc5\x9c\xdbp\x13\x87\x9f\xbcy/\xcc\xd6^;QtV15\xe6\xbf\xecZ\x96\x177\xfd\xe0\x80\xd1K\xa2k\xe6\x00E\x0fg\xcekr\xacp\x18\xa5B\xbc2\x8b\xe3\xe4\xf8\x9cm\xc5a\x03nk\x0cZ\xd9\xc2\xec\xa8"\xf5&\xe2\xa1\xf6\x8c\xad\x8e$u\xb3\x06\xf0\xc2\x82\x9e\x12\xc3;'\xf2E\x85\x9c7F\xd4\xffb\xbd\x11c\xc8\xec IoControlCode => 3735560 InBuffer => \xde\xf6\x1f\xa1Q\x0b\x97\xaf\xb0o+|D\xfe,\xea\x92\xed\xbe\xc5a<\x81\x92\xed\xbe\xc5a<\x81\x92\xed\xbe\xc5a&S\x14\x15nF+\x13\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000001 | |
| 09:18:01,055 | 452 | DeviceIoControl |
DeviceHandle => 0x00000090 OutBuffer => )\xba#\x81w\xad\xf9o\x14\x8e\xb3J\x16\x17\xdd\x8eBB\xaa\xa5'\xfc0\xcd>\x16\x18\xa5?t\xdc~\x11\xdc\x1aU\xfbO\xe7\xdef\xaa\x1b\x14\xb1L\x8dq\x8b\xd6;\x804z\xd3{p\xddl\x8cP\x97\xaeJ\x1f\xba\x93Q\xafs\xda\xa9\xb2\x8b\x96k"}\x0c\x0b:\xcb"\xd9\xf9\x8a\xd3\xa5\xab \x10\x1e\xd5q\xc4\xcbW.T\xf2\xc0\x80\xbc\x92K$\x9b\xec3\x9cT\x8f*0\xab\xbe\x08\xa7\xbf\x8b\x83\x1b:<v\xd3|I*n\xd5dK\xa3\xd4\x19\xa1\xea\xef.\xcd\xfe/\xc8\x88tR\x97\xab\xe7\x05\x01\xc7SX\xa9\xbc\xc1\x90\xd7\xc6\x91\xbb\x0btV-g\x02\xca\xf0\x85g\xaa\xb8h\xf9\xff\x07aY\x17\xb9\x0b\x17\xf87v1\xcf\xaf6\x9cU\xd4\x1c7\x1bN\xbb\xe8\x19\xd6k@M\xa4\xdf\xea\x1c\x9b\xc6\xbd\xca}B\xc1k5\xb7>\x89hgZ\x02z\xfe\xea\xc6\xb2\xf8\xedQ\x8f2\xcc\xa5\xc60\xab?*\xd4\x8dj\xdfi\xaf<.\x94>\xf51\xa9 IoControlCode => 3735560 InBuffer => \xde\xf6\x1f\xa1Q\x0b\x97\xaf\xb0o+|D\xfe,\xea\x92\xed\xbe\xc5a<\x81\x92\xed\xbe\xc5a<\x81\x92\xed\xbe\xc5a<\x81\x92\xed\xbe\xc5a&S\x14\x15nF+\x13\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000001 | |
| 09:18:01,055 | 452 | DeviceIoControl |
DeviceHandle => 0x00000090 OutBuffer => \x1e\x8a\xc8\xcd;\xb3\x1fK\xcd\x9c#\xb2r\xc6\x1a\xe8\x9a\x92\x1c\xc6\x07>L\xd2\xcf#\xe5\xb3\xd9\xb2\xc9\xd3\x80\x18\x89\xef\xd6\xcbDu\xaa\x07\xcbo\x02tN\xa4R&\xf0>\xa3\x98\x88\xb0\xf4\xbf2\xbei\xe1\xe5\x19\x89\x0b\xb9\xa6(\xa0E\xa0~w\x95\x1at\x90\xed\\x94\xd8\x11\x17\xe8)\x17&\x06\xe0\x9av\xc80\xb8%\xc1\x80s\x9et\x8a2\x9dT\xf0&\xfbvE\xd5\xe2pJ\xd4\x82YBB\xa2\xb9\xd8\xc0/\xc7\xd4\x80?\x90\x911cHT]\xf8\x9e\xd8l\x00a\xb4\x0bF\xe9\xfa\x8aA\xa7m\x8a\x84@\xa2\xd2&\xc3\x0f\x15l\x84\x93G@I\xa4\xcb6\xec\xab\x8cRK\x07A\x89b\xe8\xaa\xa0\xa4\x02\x05\xecss\xaa\xc7\x0b\xa7\xfa\x14D\xe1\x14Y\x83\x90$\x86=Mc\xb5\xa5\x9c\xfb"?\xfeJ\x98\xb0\xd5k\xdcS\x8c%\x8ffx^\x7f\x91\x0b\xaf\xdaV'v\xa9k\x8b\xc2tR\xb6\x8a\xd9\x14\xba\xcc\xb7+\xd3|\xb2\x89\xd9\xc6L\xb4ct\x86 IoControlCode => 3735560 InBuffer => \xde\xf6\x1f\xa1Q\x0b\x97\xaf\xb0o+|D\xfe,\xea\x92\xed\xbe\xc5a<\x81\x92\xed\xbe\xc5a<\x81\x92\xed\xbe\xc5a<\x81\x92\xed\xbe\xc5a<\x81\x92\xed\xbe\xc5a&S\x14\x15nF+\x13\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000001 | |
| 09:18:01,055 | 452 | DeviceIoControl |
DeviceHandle => 0x00000090 OutBuffer => \x86\x9a\xe4a4l\x81\x1f1\xa2\xaf\xa6J\xdeC\xb0r\x99\xfe\xf02(\xbba0"\xdf\x0fW\xcd\xaf=\x14\xf3Z7(c\xe8U=\x88\xdb\x17\x93\xfazJ\xf8\x81\x93\xf5V\xff\x86\x88\x9b\x87 \x08(\x0e(\x99V\xcb\x97k\xb3\x95i\xd1\xfb\xc0\xa3\x83 \xe4;\xc3\xf7\x0eRz\xe2'\xa8\x94\x9a\x8e\x1d\x0b$>\xe2} \xb7\x9e\x80;J\xcdx\xcdn\xfb\xf6\xf52C\x1b<\x9cR\xf1\xe3\xfd\xf6\xc8\xfd\x1a\xac+=`Nu\xae\xe9Le:\x10M \xaa\x8e\xe5p\xba\x87\xb3\x98X&Yb\x81\xaf(^/*\xc7'\x16eB\xc1nA\x85\xec\xc5\xa6G\x14u\x84\x9b \x08\xaa'\xb5q[\xac}\x06\x8b\x1d\xe6m\xeb4~\xd4\xb8I\x1d\x85\xf6z\x18ND\xf0\xf8c\x86\x89k9\x83HK\xfb\xaa\x00\xf1\xf9\xc2*\xb5\xf9\xff\x97\x08#\xc0aG\xb8\x9b\x9c\x9au\xb2+\xb07\xcc:\xb7\xed\xad\x1d\xbeb_\xc6\xeb~Q\xcc\x0eq\xea\xf31x\x05\x8d\xe3 IoControlCode => 3735560 InBuffer => \xde\xf6\x1f\xa1Q\x0b\x97\xaf\xb0o+|D\xfe,\xea\x92\xed\xbe\xc5a<\x81\x92\xed\xbe\xc5a<\x81\x92\xed\xbe\xc5a<\x81\x92\xed\xbe\xc5a<\x81\x92\xed\xbe\xc5a<\x81\x92\xed\xbe\xc5a&S\x14\x15nF+\x13\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000001 | |
| 09:18:01,055 | 452 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Adobe\Acrobat Reader\11.0\Privileged |
FAILURE | 0x00000002 | 1 time |
| 09:18:01,055 | 452 | RegOpenKeyExW |
Handle => 0x000000d8 Registry => 0x80000002 SubKey => SOFTWARE\Policies\Adobe\Acrobat Reader\11.0 |
SUCCESS | 0x00000000 | |
| 09:18:01,055 | 452 | RegQueryValueExW |
Handle => 0x000000d8 DataLength => 4 ValueName => bEnforceReadRestrictions Type => 1244092 |
FAILURE | 0x00000002 | |
| 09:18:01,055 | 452 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Adobe\Acrobat Reader\11.0\Privileged |
FAILURE | 0x00000002 | |
| 09:18:01,055 | 452 | RegQueryValueExW |
Handle => 0x00000000 DataLength => 4 ValueName => bEnforceReadRestrictions Type => 4 |
FAILURE | 0x00000006 | |
| 09:18:01,055 | 452 | RegCloseKey |
Handle => 0x000000d8 |
SUCCESS | 0x00000000 | |
| 09:18:01,055 | 452 | RegOpenKeyExW |
Handle => 0x000000d8 Registry => 0x80000002 SubKey => SOFTWARE\Policies\Adobe\Acrobat Reader\11.0 |
SUCCESS | 0x00000000 | |
| 09:18:01,055 | 452 | RegQueryValueExW |
Handle => 0x000000d8 DataLength => 4 ValueName => bEnableGlobalAtomRestrictions Type => 1244092 |
FAILURE | 0x00000002 | |
| 09:18:01,055 | 452 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Adobe\Acrobat Reader\11.0\Privileged |
FAILURE | 0x00000002 | |
| 09:18:01,055 | 452 | RegQueryValueExW |
Handle => 0x00000000 DataLength => 4 ValueName => bEnableGlobalAtomRestrictions Type => 4 |
FAILURE | 0x00000006 | |
| 09:18:01,055 | 452 | RegCloseKey |
Handle => 0x000000d8 |
SUCCESS | 0x00000000 | |
| 09:18:01,055 | 452 | RegOpenKeyExW |
Handle => 0x000000d8 Registry => 0x80000002 SubKey => SOFTWARE\Policies\Adobe\Acrobat Reader\11.0 |
SUCCESS | 0x00000000 | |
| 09:18:01,055 | 452 | RegQueryValueExW |
Handle => 0x000000d8 DataLength => 4 ValueName => bPreventCreatingExecutables Type => 1244092 |
FAILURE | 0x00000002 | |
| 09:18:01,065 | 452 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Adobe\Acrobat Reader\11.0\Privileged |
FAILURE | 0x00000002 | |
| 09:18:01,065 | 452 | RegQueryValueExW |
Handle => 0x00000000 DataLength => 4 ValueName => bPreventCreatingExecutables Type => 4 |
FAILURE | 0x00000006 | |
| 09:18:01,065 | 452 | RegCloseKey |
Handle => 0x000000d8 |
SUCCESS | 0x00000000 | |
| 09:18:01,065 | 452 | RegOpenKeyExW |
Handle => 0x000000d8 Registry => 0x80000002 SubKey => SOFTWARE\Policies\Adobe\Acrobat Reader\11.0 |
SUCCESS | 0x00000000 | |
| 09:18:01,065 | 452 | RegQueryValueExW |
Handle => 0x000000d8 DataLength => 4 ValueName => bEnableBinaryPlantingProtection Type => 1244092 |
FAILURE | 0x00000002 | |
| 09:18:01,065 | 452 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Adobe\Acrobat Reader\11.0\Privileged |
FAILURE | 0x00000002 | |
| 09:18:01,065 | 452 | RegQueryValueExW |
Handle => 0x00000000 DataLength => 4 ValueName => bEnableBinaryPlantingProtection Type => 4 |
FAILURE | 0x00000006 | |
| 09:18:01,065 | 452 | RegCloseKey |
Handle => 0x000000d8 |
SUCCESS | 0x00000000 | |
| 09:18:01,065 | 452 | RegOpenKeyExW |
Handle => 0x000000d8 Registry => 0x80000002 SubKey => Software\Policies\Adobe\Acrobat Reader\11.0\FeatureLockDown |
SUCCESS | 0x00000000 | |
| 09:18:01,065 | 452 | RegQueryValueExW |
Handle => 0x000000d8 DataLength => 4 ValueName => bEnableSameObjectCheck Type => 1244160 |
FAILURE | 0x00000002 | |
| 09:18:01,065 | 452 | RegCloseKey |
Handle => 0x000000d8 |
SUCCESS | 0x00000000 | |
| 09:18:01,065 | 452 | RegOpenKeyExW |
Handle => 0x000000d8 Registry => 0x80000002 SubKey => Software\Policies\Adobe\Acrobat Reader\11.0\FeatureLockDown |
SUCCESS | 0x00000000 | |
| 09:18:01,065 | 452 | RegQueryValueExW |
Handle => 0x000000d8 DataLength => 4 ValueName => bFilePathPreprocessingShortcutEnabled Type => 1244160 |
FAILURE | 0x00000002 | |
| 09:18:01,065 | 452 | RegCloseKey |
Handle => 0x000000d8 |
SUCCESS | 0x00000000 | |
| 09:18:01,065 | 452 | LdrLoadDll |
Flags => 1243912 BaseAddress => 0x77dd0000 FileName => ADVAPI32.DLL |
SUCCESS | 0x00000000 | |
| 09:18:01,065 | 452 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => SystemFunction036 FunctionAddress => 0x77dd8292 ModuleHandle => 0x77dd0000 |
SUCCESS | 0x00000000 | |
| 09:18:01,105 | 452 | RegOpenKeyExW |
Handle => 0x000000d8 Registry => 0x80000002 SubKey => Software\Adobe\Acrobat Reader\11.0\Installer |
SUCCESS | 0x00000000 | |
| 09:18:01,105 | 452 | RegQueryValueExW |
Handle => 0x000000d8 Data => C\x00:\x00\\x00P\x00r\x00o\x00g\x00r\x00a\x00m\x00 \x00F\x00i\x00l\x00e\x00s\x00\\x00A\x00d\x00o\x00b\x00e\x00\\x00R\x00e\x00a\x00d\x00e\x00r\x00 \x001\x001\x00.\x000\x00\\x00\x00\x00 ValueName => Path |
SUCCESS | 0x00000000 | |
| 09:18:01,105 | 452 | RegCloseKey |
Handle => 0x000000d8 |
SUCCESS | 0x00000000 | |
| 09:18:01,105 | 452 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x001d11a8 | |
| 09:18:01,105 | 452 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x001d11a8 | |
| 09:18:01,135 | 452 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x001d11a8 | |
| 09:18:01,135 | 452 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x001d11a8 | |
| 09:18:01,135 | 452 | NtCreateFile |
ShareAccess => 0 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\sep14tax-c8.pdf DesiredAccess => 0x00100080 CreateDisposition => 1 FileHandle => 0x000000d8 |
SUCCESS | 0x00000000 | |
| 09:18:01,135 | 452 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x0018a9a8 | |
| 09:18:01,135 | 452 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Temp |
SUCCESS | 0x0018a9a8 | |
| 09:18:01,135 | 452 | NtOpenDirectoryObject |
DirectoryHandle => 0x000000d8 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:01,165 | 452 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x0018a9a8 | |
| 09:18:01,165 | 452 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Temp |
SUCCESS | 0x0018a9a8 | |
| 09:18:01,165 | 452 | LdrLoadDll |
Flags => 1242576 BaseAddress => 0x71b20000 FileName => MPR.dll |
SUCCESS | 0x00000000 | |
| 09:18:01,165 | 452 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => WNetGetUniversalNameW FunctionAddress => 0x71b2c7a6 ModuleHandle => 0x71b20000 |
SUCCESS | 0x00000000 | |
| 09:18:01,175 | 452 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Adobe\Acrobat Reader\11.0\AVGeneral\cRecentFiles\c1 |
FAILURE | 0x00000002 | |
| 09:18:01,175 | 452 | CreateThread |
ThreadId => 488 StartRoutine => 0x00420110 Parameter => 0x00d9c860 CreationFlags => 0 |
SUCCESS | 0x000000f0 | |
| 09:18:01,175 | 452 | CreateThread |
ThreadId => 472 StartRoutine => 0x00420670 Parameter => 0x00d558c0 CreationFlags => 0 |
SUCCESS | 0x000000fc | |
| 09:18:01,185 | 452 | RegOpenKeyExW |
Handle => 0x00000100 Registry => 0x80000002 SubKey => Software\Policies\Adobe\Acrobat Reader\11.0\FeatureLockDown |
SUCCESS | 0x00000000 | |
| 09:18:01,185 | 452 | RegQueryValueExW |
Handle => 0x00000100 DataLength => 4 ValueName => bDisableCryptBroker Type => 1243612 |
FAILURE | 0x00000002 | |
| 09:18:01,185 | 452 | RegCloseKey |
Handle => 0x00000100 |
SUCCESS | 0x00000000 | |
| 09:18:01,185 | 452 | CreateThread |
ThreadId => 508 StartRoutine => 0x00421670 Parameter => 0x00d9d860 CreationFlags => 0 |
SUCCESS | 0x00000108 | |
| 09:18:01,185 | 452 | CreateThread |
ThreadId => 348 StartRoutine => 0x004217e0 Parameter => 0x00d9c8d0 CreationFlags => 0 |
SUCCESS | 0x00000114 | |
| 09:18:01,185 | 452 | CreateThread |
ThreadId => 548 StartRoutine => 0x004219b0 Parameter => 0x00d55980 CreationFlags => 0 |
SUCCESS | 0x00000120 | |
| 09:18:01,185 | 452 | CreateThread |
ThreadId => 264 StartRoutine => 0x00421e70 Parameter => 0x0039a8e8 CreationFlags => 0 |
SUCCESS | 0x0000012c | |
| 09:18:01,185 | 452 | NtOpenKey |
DesiredAccess => 33554432 KeyHandle => 0x00000130 ObjectAttributes => \REGISTRY\USER\S-1-5-21-1935655697-1606980848-1060284298-1003 |
SUCCESS | 0x00000000 | |
| 09:18:01,195 | 452 | NtOpenKey |
DesiredAccess => 983103 KeyHandle => 0x00000134 ObjectAttributes => Keyboard Layout\Preload |
SUCCESS | 0x00000000 | |
| 09:18:01,195 | 452 | NtQueryValueKey |
Information => 0\x000\x000\x000\x000\x004\x000\x009\x00\x00\x00 KeyHandle => 0x00000134 ValueName => 1 Type => 1 |
SUCCESS | 0x00000000 | |
| 09:18:01,195 | 452 | NtOpenKey |
DesiredAccess => 131097 KeyHandle => 0x00000130 ObjectAttributes => \Registry\Machine\System\CurrentControlSet\Control\Keyboard Layouts\00000409 |
SUCCESS | 0x00000000 | |
| 09:18:01,195 | 452 | NtQueryValueKey |
Information => K\x00B\x00D\x00U\x00S\x00.\x00D\x00L\x00L\x00\x00\x00 KeyHandle => 0x00000130 ValueName => Layout File Type => 1 |
SUCCESS | 0x00000000 | |
| 09:18:01,195 | 452 | NtQueryValueKey |
KeyHandle => 0x00000130 ValueName => Attributes |
FAILURE | 3221225524 | |
| 09:18:01,195 | 452 | LdrLoadDll |
Flags => 1240992 BaseAddress => 0x5fff0000 FileName => KBDUS.DLL |
SUCCESS | 0x00000000 | |
| 09:18:01,195 | 452 | LdrGetProcedureAddress |
Ordinal => 3 FunctionName => FunctionAddress => 0x00000003 ModuleHandle => 0x5fff0000 |
FAILURE | 3221225784 | |
| 09:18:01,195 | 452 | LdrGetProcedureAddress |
Ordinal => 5 FunctionName => FunctionAddress => 0x00000005 ModuleHandle => 0x5fff0000 |
FAILURE | 3221225784 | |
| 09:18:01,195 | 452 | LdrGetProcedureAddress |
Ordinal => 6 FunctionName => FunctionAddress => 0x00000006 ModuleHandle => 0x5fff0000 |
FAILURE | 3221225784 | |
| 09:18:01,195 | 452 | LdrGetProcedureAddress |
Ordinal => 1 FunctionName => FunctionAddress => 0x5fff1a5a ModuleHandle => 0x5fff0000 |
SUCCESS | 0x00000000 | |
| 09:18:01,195 | 452 | LdrGetProcedureAddress |
Ordinal => 2 FunctionName => FunctionAddress => 0x00000002 ModuleHandle => 0x5fff0000 |
FAILURE | 3221225784 | |
| 09:18:01,195 | 264 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CoInitialize FunctionAddress => 0x77502a53 ModuleHandle => 0x774e0000 |
SUCCESS | 0x00000000 | 1 time |
| 09:18:01,205 | 452 | NtCreateFile |
ShareAccess => 1 FileName => C:\WINDOWS\system32\KBDUS.DLL DesiredAccess => 0x80100080 CreateDisposition => 1 FileHandle => 0x00000140 |
SUCCESS | 0x00000000 | |
| 09:18:01,205 | 452 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => adialhk.dll |
FAILURE | 3221225781 | 1 time |
| 09:18:01,205 | 452 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => acpiz.dll |
FAILURE | 3221225781 | 1 time |
| 09:18:01,205 | 452 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => avgrsstx.dll |
FAILURE | 3221225781 | 1 time |
| 09:18:01,205 | 452 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => babylonchromepi.dll |
FAILURE | 3221225781 | 1 time |
| 09:18:01,205 | 452 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => babylo~1.dll |
FAILURE | 3221225781 | 1 time |
| 09:18:01,205 | 452 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => btkeyind.dll |
FAILURE | 3221225781 | 1 time |
| 09:18:01,205 | 452 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => cmcsyshk.dll |
FAILURE | 3221225781 | 1 time |
| 09:18:01,205 | 452 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => cmsetac.dll |
FAILURE | 3221225781 | 1 time |
| 09:18:01,205 | 452 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => cooliris.dll |
FAILURE | 3221225781 | 1 time |
| 09:18:01,205 | 452 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => dockshellhook.dll |
FAILURE | 3221225781 | 1 time |
| 09:18:01,205 | 452 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => docksh~1.dll |
FAILURE | 3221225781 | 1 time |
| 09:18:01,205 | 452 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => easyhook32.dll |
FAILURE | 3221225781 | 1 time |
| 09:18:01,205 | 452 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => easyho~1.dll |
FAILURE | 3221225781 | 1 time |
| 09:18:01,205 | 452 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => googledesktopnetwork3.dll |
FAILURE | 3221225781 | 1 time |
| 09:18:01,205 | 452 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => google~1.dll |
FAILURE | 3221225781 | 1 time |
| 09:18:01,205 | 452 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => fwhook.dll |
FAILURE | 3221225781 | 1 time |
| 09:18:01,205 | 452 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => hookprocesscreation.dll |
FAILURE | 3221225781 | 1 time |
| 09:18:01,205 | 452 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => hookpr~1.dll |
FAILURE | 3221225781 | 1 time |
| 09:18:01,205 | 452 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => hookterminateapis.dll |
FAILURE | 3221225781 | 1 time |
| 09:18:01,205 | 452 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => hookte~1.dll |
FAILURE | 3221225781 | 1 time |
| 09:18:01,205 | 452 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => hookprintapis.dll |
FAILURE | 3221225781 | 1 time |
| 09:18:01,205 | 452 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => hookpr~1.dll |
FAILURE | 3221225781 | 1 time |
| 09:18:01,205 | 452 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => imon.dll |
FAILURE | 3221225781 | 1 time |
| 09:18:01,205 | 452 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => ioloHL.dll |
FAILURE | 3221225781 | 1 time |
| 09:18:01,205 | 452 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => kloehk.dll |
FAILURE | 3221225781 | 1 time |
| 09:18:01,205 | 452 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => lawenforcer.dll |
FAILURE | 3221225781 | 1 time |
| 09:18:01,205 | 452 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => lawenf~1.dll |
FAILURE | 3221225781 | 1 time |
| 09:18:01,205 | 452 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => libdivx.dll |
FAILURE | 3221225781 | 1 time |
| 09:18:01,205 | 452 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => lvprcinj01.dll |
FAILURE | 3221225781 | 1 time |
| 09:18:01,205 | 452 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => lvprci~1.dll |
FAILURE | 3221225781 | 1 time |
| 09:18:01,205 | 452 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => madchook.dll |
FAILURE | 3221225781 | 1 time |
| 09:18:01,205 | 452 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => mdnsnsp.dll |
FAILURE | 3221225781 | 1 time |
| 09:18:01,205 | 452 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => moonsysh.dll |
FAILURE | 3221225781 | 1 time |
| 09:18:01,205 | 452 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => mpk.dll |
FAILURE | 3221225781 | 1 time |
| 09:18:01,205 | 452 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => npdivx32.dll |
FAILURE | 3221225781 | 1 time |
| 09:18:01,205 | 452 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => npggNT.des |
FAILURE | 3221225781 | 1 time |
| 09:18:01,205 | 452 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => npggNT.dll |
FAILURE | 3221225781 | 1 time |
| 09:18:01,205 | 452 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => oawatch.dll |
FAILURE | 3221225781 | 1 time |
| 09:18:01,205 | 452 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => owexplorer-10513.dll |
FAILURE | 3221225781 | 1 time |
| 09:18:01,205 | 452 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => owexpl~1.dll |
FAILURE | 3221225781 | 1 time |
| 09:18:01,205 | 452 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => owexplorer-10514.dll |
FAILURE | 3221225781 | 1 time |
| 09:18:01,205 | 452 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => owexpl~1.dll |
FAILURE | 3221225781 | 1 time |
| 09:18:01,205 | 452 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => owexplorer-10515.dll |
FAILURE | 3221225781 | 1 time |
| 09:18:01,205 | 452 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => owexpl~1.dll |
FAILURE | 3221225781 | 1 time |
| 09:18:01,205 | 452 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => owexplorer-10516.dll |
FAILURE | 3221225781 | 1 time |
| 09:18:01,205 | 452 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => owexpl~1.dll |
FAILURE | 3221225781 | 1 time |
| 09:18:01,205 | 452 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => owexplorer-10517.dll |
FAILURE | 3221225781 | 1 time |
| 09:18:01,205 | 452 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => owexpl~1.dll |
FAILURE | 3221225781 | 1 time |
| 09:18:01,205 | 452 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => owexplorer-10518.dll |
FAILURE | 3221225781 | 1 time |
| 09:18:01,205 | 452 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => owexpl~1.dll |
FAILURE | 3221225781 | 1 time |
| 09:18:01,205 | 452 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => owexplorer-10519.dll |
FAILURE | 3221225781 | 1 time |
| 09:18:01,205 | 452 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => owexpl~1.dll |
FAILURE | 3221225781 | 1 time |
| 09:18:01,205 | 452 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => owexplorer-10520.dll |
FAILURE | 3221225781 | 1 time |
| 09:18:01,205 | 452 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => owexpl~1.dll |
FAILURE | 3221225781 | 1 time |
| 09:18:01,205 | 452 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => owexplorer-10521.dll |
FAILURE | 3221225781 | 1 time |
| 09:18:01,205 | 452 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => owexpl~1.dll |
FAILURE | 3221225781 | 1 time |
| 09:18:01,205 | 452 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => owexplorer-10522.dll |
FAILURE | 3221225781 | 1 time |
| 09:18:01,205 | 452 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => owexpl~1.dll |
FAILURE | 3221225781 | 1 time |
| 09:18:01,205 | 452 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => owexplorer-10523.dll |
FAILURE | 3221225781 | 1 time |
| 09:18:01,205 | 452 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => owexpl~1.dll |
FAILURE | 3221225781 | 1 time |
| 09:18:01,205 | 452 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => pavhook.dll |
FAILURE | 3221225781 | 1 time |
| 09:18:01,205 | 452 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => pavlsphook.dll |
FAILURE | 3221225781 | 1 time |
| 09:18:01,205 | 452 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => pavlsp~1.dll |
FAILURE | 3221225781 | 1 time |
| 09:18:01,205 | 452 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => pavshook.dll |
FAILURE | 3221225781 | 1 time |
| 09:18:01,205 | 452 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => pavshookwow.dll |
FAILURE | 3221225781 | 1 time |
| 09:18:01,205 | 452 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => pavsho~1.dll |
FAILURE | 3221225781 | 1 time |
| 09:18:01,205 | 452 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => pctavhook.dll |
FAILURE | 3221225781 | 1 time |
| 09:18:01,205 | 452 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => pctavh~1.dll |
FAILURE | 3221225781 | 1 time |
| 09:18:01,205 | 452 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => pctgmhk.dll |
FAILURE | 3221225781 | 1 time |
| 09:18:01,205 | 452 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => prntrack.dll |
FAILURE | 3221225781 | 1 time |
| 09:18:01,205 | 452 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => protector.dll |
FAILURE | 3221225781 | 1 time |
| 09:18:01,205 | 452 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => protec~1.dll |
FAILURE | 3221225781 | 1 time |
| 09:18:01,205 | 452 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => radhslib.dll |
FAILURE | 3221225781 | 1 time |
| 09:18:01,205 | 452 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => radprlib.dll |
FAILURE | 3221225781 | 1 time |
| 09:18:01,205 | 452 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => rapportnikko.dll |
FAILURE | 3221225781 | 1 time |
| 09:18:01,205 | 452 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => rappor~1.dll |
FAILURE | 3221225781 | 1 time |
| 09:18:01,205 | 452 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => rlhook.dll |
FAILURE | 3221225781 | 1 time |
| 09:18:01,205 | 452 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => rooksdol.dll |
FAILURE | 3221225781 | 1 time |
| 09:18:01,205 | 452 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => rpchromebrowserrecordhelper.dll |
FAILURE | 3221225781 | 1 time |
| 09:18:01,205 | 452 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => rpchro~1.dll |
FAILURE | 3221225781 | 1 time |
| 09:18:01,205 | 452 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => r3hook.dll |
FAILURE | 3221225781 | 1 time |
| 09:18:01,205 | 452 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => sahook.dll |
FAILURE | 3221225781 | 1 time |
| 09:18:01,205 | 452 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => sbrige.dll |
FAILURE | 3221225781 | 1 time |
| 09:18:01,205 | 452 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => sc2hook.dll |
FAILURE | 3221225781 | 1 time |
| 09:18:01,205 | 452 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => sdhook32.dll |
FAILURE | 3221225781 | 1 time |
| 09:18:01,205 | 452 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => sguard.dll |
FAILURE | 3221225781 | 1 time |
| 09:18:01,205 | 452 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => smum32.dll |
FAILURE | 3221225781 | 1 time |
| 09:18:01,215 | 452 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => smumhook.dll |
FAILURE | 3221225781 | 1 time |
| 09:18:01,215 | 452 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => ssldivx.dll |
FAILURE | 3221225781 | 1 time |
| 09:18:01,215 | 452 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => syncor11.dll |
FAILURE | 3221225781 | 1 time |
| 09:18:01,215 | 452 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => systools.dll |
FAILURE | 3221225781 | 1 time |
| 09:18:01,215 | 452 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => tfwah.dll |
FAILURE | 3221225781 | 1 time |
| 09:18:01,215 | 452 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => wblind.dll |
FAILURE | 3221225781 | 1 time |
| 09:18:01,215 | 452 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => wbhelp.dll |
FAILURE | 3221225781 | 1 time |
| 09:18:01,215 | 452 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => winstylerthemehelper.dll |
FAILURE | 3221225781 | 1 time |
| 09:18:01,215 | 452 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => winsty~1.dll |
FAILURE | 3221225781 | 1 time |
| 09:18:01,215 | 452 | RegOpenKeyExW |
Handle => 0x00000150 Registry => 0x80000002 SubKey => Software\Policies\Adobe\Acrobat Reader\11.0\FeatureLockDown |
SUCCESS | 0x00000000 | |
| 09:18:01,215 | 452 | RegQueryValueExW |
Handle => 0x00000150 DataLength => 4 ValueName => bUseWhitelistConfigFile Type => 1243632 |
FAILURE | 0x00000002 | |
| 09:18:01,215 | 452 | RegCloseKey |
Handle => 0x00000150 |
SUCCESS | 0x00000000 | |
| 09:18:01,215 | 452 | RegOpenKeyExW |
Handle => 0x00000150 Registry => 0x80000002 SubKey => Software\Adobe\Acrobat Reader\11.0\Installer |
SUCCESS | 0x00000000 | |
| 09:18:01,215 | 452 | RegQueryValueExW |
Handle => 0x00000150 Data => C\x00:\x00\\x00P\x00r\x00o\x00g\x00r\x00a\x00m\x00 \x00F\x00i\x00l\x00e\x00s\x00\\x00A\x00d\x00o\x00b\x00e\x00\\x00R\x00e\x00a\x00d\x00e\x00r\x00 \x001\x001\x00.\x000\x00\\x00\x00\x00 ValueName => Path |
SUCCESS | 0x00000000 | |
| 09:18:01,215 | 452 | RegCloseKey |
Handle => 0x00000150 |
SUCCESS | 0x00000000 | |
| 09:18:01,215 | 452 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => SHGetFolderPathW FunctionAddress => 0x7c9eed76 ModuleHandle => 0x7c9c0000 |
SUCCESS | 0x00000000 | |
| 09:18:01,215 | 452 | RegOpenKeyExW |
Handle => 0x00000154 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion |
SUCCESS | 0x00000000 | |
| 09:18:01,215 | 452 | RegQueryValueExW |
Handle => 0x00000154 Data => C\x00:\x00\\x00P\x00r\x00o\x00g\x00r\x00a\x00m\x00 \x00F\x00i\x00l\x00e\x00s\x00\x00\x00 ValueName => ProgramFilesDir |
SUCCESS | 0x00000000 | |
| 09:18:01,215 | 452 | RegCloseKey |
Handle => 0x00000154 |
SUCCESS | 0x00000000 | |
| 09:18:01,215 | 452 | FindFirstFileExW |
FileName => C:\WINDOWS |
SUCCESS | 0x001e61a8 | 1 time |
| 09:18:01,215 | 452 | RegOpenKeyExW |
Handle => 0x00000154 Registry => 0x80000002 SubKey => Software\Adobe\Acrobat Reader\11.0\Installer |
SUCCESS | 0x00000000 | |
| 09:18:01,215 | 452 | RegQueryValueExW |
Handle => 0x00000154 Data => C\x00:\x00\\x00P\x00r\x00o\x00g\x00r\x00a\x00m\x00 \x00F\x00i\x00l\x00e\x00s\x00\\x00A\x00d\x00o\x00b\x00e\x00\\x00R\x00e\x00a\x00d\x00e\x00r\x00 \x001\x001\x00.\x000\x00\\x00\x00\x00 ValueName => Path |
SUCCESS | 0x00000000 | |
| 09:18:01,215 | 452 | RegCloseKey |
Handle => 0x00000154 |
SUCCESS | 0x00000000 | |
| 09:18:01,215 | 452 | FindFirstFileExW |
FileName => C:\Program Files\Adobe |
SUCCESS | 0x001e61a8 | 2 times |
| 09:18:01,215 | 452 | FindFirstFileExW |
FileName => C:\Program Files\Adobe\Reader 11.0\Reader |
SUCCESS | 0x001e61a8 | |
| 09:18:01,215 | 452 | FindFirstFileExW |
FileName => C:\Program Files\Adobe |
SUCCESS | 0x001e61a8 | |
| 09:18:01,215 | 452 | FindFirstFileExW |
FileName => C:\Program Files\Adobe\Reader 11.0\Reader |
SUCCESS | 0x001e61a8 | |
| 09:18:01,215 | 452 | RegCreateKeyExW |
Handle => 0x00000154 Access => 33554432 Registry => 0x80000001 Class => SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders |
SUCCESS | 0x00000000 | |
| 09:18:01,215 | 452 | RegQueryValueExW |
Handle => 0x00000154 Data => %\x00U\x00S\x00E\x00R\x00P\x00R\x00O\x00F\x00I\x00L\x00E\x00%\x00\\x00A\x00p\x00p\x00l\x00i\x00c\x00a\x00t\x00i\x00o\x00n\x00 \x00D\x00a\x00t\x00a\x00\x00\x00 ValueName => AppData |
SUCCESS | 0x00000000 | |
| 09:18:01,215 | 452 | RegCloseKey |
Handle => 0x00000154 |
SUCCESS | 0x00000000 | |
| 09:18:01,215 | 452 | RegCreateKeyExW |
Handle => 0x00000154 Access => 33554432 Registry => 0x80000001 Class => SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders |
SUCCESS | 0x00000000 | |
| 09:18:01,215 | 452 | RegSetValueExW |
Handle => 0x00000154 Buffer => C\x00:\x00\\x00D\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00s\x00 \x00a\x00n\x00d\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00D\x00W\x00\\x00A\x00p\x00p\x00l\x00i\x00c\x00a\x00t\x00i\x00o\x00n\x00 \x00D\x00a\x00t\x00a\x00\x00\x00 ValueName => AppData Type => 1 |
SUCCESS | 0x00000000 | |
| 09:18:01,215 | 452 | RegCloseKey |
Handle => 0x00000154 |
SUCCESS | 0x00000000 | |
| 09:18:01,215 | 452 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x001e69a8 | 5 times |
| 09:18:01,225 | 452 | RegCreateKeyExW |
Handle => 0x0000015c Access => 33554432 Registry => 0x80000001 Class => SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders |
SUCCESS | 0x00000000 | |
| 09:18:01,225 | 452 | RegQueryValueExW |
Handle => 0x0000015c Data => %\x00U\x00S\x00E\x00R\x00P\x00R\x00O\x00F\x00I\x00L\x00E\x00%\x00\\x00L\x00o\x00c\x00a\x00l\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00A\x00p\x00p\x00l\x00i\x00c\x00a\x00t\x00i\x00o\x00n\x00 \x00D\x00a\x00t\x00a\x00\x00\x00 ValueName => Local AppData |
SUCCESS | 0x00000000 | |
| 09:18:01,225 | 452 | RegCloseKey |
Handle => 0x0000015c |
SUCCESS | 0x00000000 | |
| 09:18:01,225 | 452 | RegCreateKeyExW |
Handle => 0x0000015c Access => 33554432 Registry => 0x80000001 Class => SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders |
SUCCESS | 0x00000000 | |
| 09:18:01,225 | 452 | RegSetValueExW |
Handle => 0x0000015c Buffer => C\x00:\x00\\x00D\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00s\x00 \x00a\x00n\x00d\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00D\x00W\x00\\x00L\x00o\x00c\x00a\x00l\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00A\x00p\x00p\x00l\x00i\x00c\x00a\x00t\x00i\x00o\x00n\x00 \x00D\x00a\x00t\x00a\x00\x00\x00 ValueName => Local AppData Type => 1 |
SUCCESS | 0x00000000 | |
| 09:18:01,225 | 452 | RegCloseKey |
Handle => 0x0000015c |
SUCCESS | 0x00000000 | |
| 09:18:01,225 | 452 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x001e69a8 | 3 times |
| 09:18:01,225 | 452 | RegCreateKeyExW |
Handle => 0x0000015c Access => 33554432 Registry => 0x80000001 Class => SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders |
SUCCESS | 0x00000000 | |
| 09:18:01,225 | 452 | RegQueryValueExW |
Handle => 0x0000015c Data => %\x00U\x00S\x00E\x00R\x00P\x00R\x00O\x00F\x00I\x00L\x00E\x00%\x00\\x00L\x00o\x00c\x00a\x00l\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00e\x00m\x00p\x00o\x00r\x00a\x00r\x00y\x00 \x00I\x00n\x00t\x00e\x00r\x00n\x00e\x00t\x00 \x00F\x00i\x00l\x00e\x00s\x00\x00\x00 ValueName => Cache |
SUCCESS | 0x00000000 | |
| 09:18:01,225 | 452 | RegCloseKey |
Handle => 0x0000015c |
SUCCESS | 0x00000000 | |
| 09:18:01,225 | 452 | RegCreateKeyExW |
Handle => 0x0000015c Access => 33554432 Registry => 0x80000001 Class => SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders |
SUCCESS | 0x00000000 | |
| 09:18:01,225 | 452 | RegSetValueExW |
Handle => 0x0000015c Buffer => C\x00:\x00\\x00D\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00s\x00 \x00a\x00n\x00d\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00D\x00W\x00\\x00L\x00o\x00c\x00a\x00l\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00e\x00m\x00p\x00o\x00r\x00a\x00r\x00y\x00 \x00I\x00n\x00t\x00e\x00r\x00n\x00e\x00t\x00 \x00F\x00i\x00l\x00e\x00s\x00\x00\x00 ValueName => Cache Type => 1 |
SUCCESS | 0x00000000 | |
| 09:18:01,225 | 452 | RegCloseKey |
Handle => 0x0000015c |
SUCCESS | 0x00000000 | |
| 09:18:01,225 | 452 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x001e69a8 | 7 times |
| 09:18:01,225 | 452 | CreateDirectoryExW |
DirectoryName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx |
SUCCESS | 0x00000001 | |
| 09:18:01,225 | 452 | NtCreateFile |
ShareAccess => 3 FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx DesiredAccess => 0x00120089 CreateDisposition => 1 FileHandle => 0x00000160 |
SUCCESS | 0x00000000 | |
| 09:18:01,235 | 452 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x001e69a8 | |
| 09:18:01,235 | 452 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x001e69a8 | |
| 09:18:01,235 | 452 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x001e69a8 | |
| 09:18:01,235 | 452 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x001e69a8 | |
| 09:18:01,235 | 348 | LdrLoadDll |
Flags => 21362876 BaseAddress => 0x5ad70000 FileName => C:\WINDOWS\system32\uxtheme.dll |
SUCCESS | 0x00000000 | |
| 09:18:01,235 | 348 | IsDebuggerPresent | FAILURE | 0x00000000 | ||
| 09:18:01,235 | 348 | LdrLoadDll |
Flags => 21362696 BaseAddress => 0x5ad70000 FileName => uxtheme.dll |
SUCCESS | 0x00000000 | |
| 09:18:01,235 | 452 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => SHCreateDirectoryExW FunctionAddress => 0x7ca0b24a ModuleHandle => 0x7c9c0000 |
SUCCESS | 0x00000000 | |
| 09:18:01,235 | 452 | CreateDirectoryW |
DirectoryName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
FAILURE | 0x00000000 | |
| 09:18:01,235 | 452 | CreateDirectoryW |
DirectoryName => C:\Documents and Settings |
FAILURE | 0x00000000 | |
| 09:18:01,235 | 452 | CreateDirectoryW |
DirectoryName => C:\Documents and Settings\TDW |
FAILURE | 0x00000000 | |
| 09:18:01,235 | 452 | CreateDirectoryW |
DirectoryName => C:\Documents and Settings\TDW\Application Data |
FAILURE | 0x00000000 | |
| 09:18:01,235 | 452 | CreateDirectoryW |
DirectoryName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00000001 | |
| 09:18:01,235 | 452 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
FAILURE | 0x00000002 | |
| 09:18:01,245 | 348 | GetSystemMetrics |
SystemMetricIndex => 31 |
SUCCESS | 0x00000019 | |
| 09:18:01,245 | 348 | ZwMapViewOfSection |
SectionOffset => 0x0145f6f0 SectionHandle => 0x00000168 ProcessHandle => 0xffffffff BaseAddress => 0x01970000 |
SUCCESS | 0x00000000 | |
| 09:18:01,245 | 452 | RegOpenKeyExW |
Handle => 0x00000170 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
SUCCESS | 0x00000000 | |
| 09:18:01,245 | 452 | RegQueryValueExW |
Handle => 0x00000170 DataLength => 4 ValueName => NoNetHood Type => 1239916 |
FAILURE | 0x00000002 | |
| 09:18:01,245 | 452 | RegCloseKey |
Handle => 0x00000170 |
SUCCESS | 0x00000000 | |
| 09:18:01,245 | 452 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
FAILURE | 0x00000002 | |
| 09:18:01,245 | 452 | RegOpenKeyExW |
Handle => 0x00000170 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
SUCCESS | 0x00000000 | |
| 09:18:01,245 | 452 | RegQueryValueExW |
Handle => 0x00000170 DataLength => 4 ValueName => NoPropertiesMyComputer Type => 1239916 |
FAILURE | 0x00000002 | |
| 09:18:01,245 | 452 | RegCloseKey |
Handle => 0x00000170 |
SUCCESS | 0x00000000 | |
| 09:18:01,245 | 452 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
FAILURE | 0x00000002 | |
| 09:18:01,245 | 452 | RegOpenKeyExW |
Handle => 0x00000170 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
SUCCESS | 0x00000000 | |
| 09:18:01,245 | 452 | RegQueryValueExW |
Handle => 0x00000170 DataLength => 4 ValueName => NoInternetIcon Type => 1239916 |
FAILURE | 0x00000002 | |
| 09:18:01,245 | 452 | RegCloseKey |
Handle => 0x00000170 |
SUCCESS | 0x00000000 | |
| 09:18:01,245 | 452 | LdrGetProcedureAddress |
Ordinal => 236 FunctionName => FunctionAddress => 0x773e1798 ModuleHandle => 0x773d0000 |
SUCCESS | 0x00000000 | |
| 09:18:01,245 | 452 | LdrGetDllHandle |
ModuleHandle => 0x774e0000 FileName => OLE32.DLL |
SUCCESS | 0x00000000 | |
| 09:18:01,245 | 452 | LdrLoadDll |
Flags => 1239076 BaseAddress => 0x774e0000 FileName => ole32.dll |
SUCCESS | 0x00000000 | |
| 09:18:01,245 | 452 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CoGetMalloc FunctionAddress => 0x774fdd08 ModuleHandle => 0x774e0000 |
SUCCESS | 0x00000000 | |
| 09:18:01,245 | 452 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
FAILURE | 0x00000002 | |
| 09:18:01,245 | 452 | RegOpenKeyExW |
Handle => 0x00000170 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
SUCCESS | 0x00000000 | |
| 09:18:01,256 | 348 | GetSystemMetrics |
SystemMetricIndex => 31 |
SUCCESS | 0x00000019 | 1 time |
| 09:18:01,256 | 452 | RegQueryValueExW |
Handle => 0x00000170 DataLength => 4 ValueName => NoCommonGroups Type => 1239916 |
FAILURE | 0x00000002 | |
| 09:18:01,256 | 452 | RegCloseKey |
Handle => 0x00000170 |
SUCCESS | 0x00000000 | |
| 09:18:01,256 | 452 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CreateBindCtx FunctionAddress => 0x774fe54c ModuleHandle => 0x774e0000 |
SUCCESS | 0x00000000 | |
| 09:18:01,256 | 452 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000002 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Objects\{20D04FE0-3AEA-1069-A2D8-08002B30309D} |
FAILURE | 0x00000002 | |
| 09:18:01,256 | 452 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
FAILURE | 0x00000002 | |
| 09:18:01,256 | 452 | RegOpenKeyExW |
Handle => 0x00000170 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
SUCCESS | 0x00000000 | |
| 09:18:01,256 | 452 | RegQueryValueExW |
Handle => 0x00000170 DataLength => 4 ValueName => NoControlPanel Type => 1238272 |
FAILURE | 0x00000002 | |
| 09:18:01,256 | 452 | RegCloseKey |
Handle => 0x00000170 |
SUCCESS | 0x00000000 | |
| 09:18:01,256 | 452 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
FAILURE | 0x00000002 | |
| 09:18:01,256 | 452 | RegOpenKeyExW |
Handle => 0x00000170 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
SUCCESS | 0x00000000 | |
| 09:18:01,256 | 452 | RegQueryValueExW |
Handle => 0x00000170 DataLength => 4 ValueName => NoSetFolders Type => 1238272 |
FAILURE | 0x00000002 | |
| 09:18:01,256 | 452 | RegCloseKey |
Handle => 0x00000170 |
SUCCESS | 0x00000000 | |
| 09:18:01,256 | 452 | RegOpenKeyExA |
Handle => 0x0000016e Registry => 0x80000000 SubKey => CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32 |
SUCCESS | 0x00000000 | |
| 09:18:01,256 | 452 | RegQueryValueExW |
Handle => 0x0000016e Data => %\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00\\x00s\x00y\x00s\x00t\x00e\x00m\x003\x002\x00\\x00S\x00H\x00E\x00L\x00L\x003\x002\x00.\x00d\x00l\x00l\x00\x00\x00 ValueName => |
SUCCESS | 0x00000000 | |
| 09:18:01,256 | 452 | LdrLoadDll |
Flags => 1238852 BaseAddress => 0x7c9c0000 FileName => C:\WINDOWS\system32\SHELL32.dll |
SUCCESS | 0x00000000 | |
| 09:18:01,266 | 452 | RegCloseKey |
Handle => 0x0000016e |
SUCCESS | 0x00000000 | |
| 09:18:01,266 | 452 | RegOpenKeyExW |
Handle => 0x0000016e Registry => 0x80000000 SubKey => Drive\shellex\FolderExtensions |
SUCCESS | 0x00000000 | |
| 09:18:01,266 | 452 | RegEnumKeyW |
Handle => 0x0000016e Name => {fbeb8a05-beee-4442-804e-409d6c4515e9} Index => 0 |
SUCCESS | 0x00000000 | |
| 09:18:01,266 | 452 | RegOpenKeyExW |
Handle => 0x00000176 Registry => 0x80000000 SubKey => Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9} |
SUCCESS | 0x00000000 | |
| 09:18:01,266 | 452 | RegQueryValueExW |
Handle => 0x00000176 Data => 32 ValueName => DriveMask |
SUCCESS | 0x00000000 | |
| 09:18:01,266 | 452 | RegCloseKey |
Handle => 0x00000176 |
SUCCESS | 0x00000000 | |
| 09:18:01,266 | 452 | RegEnumKeyW |
Handle => 0x0000016e Name => {fbeb8a05-beee-4442-804e-409d6c4515e9} Index => 1 |
FAILURE | 0x00000103 | |
| 09:18:01,266 | 452 | RegCloseKey |
Handle => 0x0000016e |
SUCCESS | 0x00000000 | |
| 09:18:01,266 | 452 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
FAILURE | 0x00000002 | |
| 09:18:01,266 | 452 | RegOpenKeyExW |
Handle => 0x0000016c Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
SUCCESS | 0x00000000 | |
| 09:18:01,266 | 452 | RegQueryValueExW |
Handle => 0x0000016c DataLength => 4 ValueName => AllowFileCLSIDJunctions Type => 1237108 |
FAILURE | 0x00000002 | |
| 09:18:01,266 | 452 | RegCloseKey |
Handle => 0x0000016c |
SUCCESS | 0x00000000 | |
| 09:18:01,266 | 452 | NtCreateSection |
ObjectAttributes => DesiredAccess => 0x000f0007 SectionHandle => 0x0000016c FileHandle => 0x00000000 |
SUCCESS | 0x00000000 | |
| 09:18:01,266 | 452 | ZwMapViewOfSection |
SectionOffset => 0x0012ef60 SectionHandle => 0x0000016c ProcessHandle => 0xffffffff BaseAddress => 0x003b0000 |
SUCCESS | 0x00000000 | |
| 09:18:01,266 | 452 | ZwMapViewOfSection |
SectionOffset => 0x0012ef80 SectionHandle => 0x00000174 ProcessHandle => 0xffffffff BaseAddress => 0x003b0000 |
SUCCESS | 0x00000000 | |
| 09:18:01,276 | 452 | CreateDirectoryW |
DirectoryName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00000001 | |
| 09:18:01,276 | 452 | RegOpenKeyExW |
Handle => 0x00000176 Registry => 0x80000000 SubKey => Drive\shellex\FolderExtensions |
SUCCESS | 0x00000000 | |
| 09:18:01,276 | 452 | RegEnumKeyW |
Handle => 0x00000176 Name => {fbeb8a05-beee-4442-804e-409d6c4515e9} Index => 0 |
SUCCESS | 0x00000000 | |
| 09:18:01,276 | 452 | RegOpenKeyExW |
Handle => 0x0000016e Registry => 0x80000000 SubKey => Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9} |
SUCCESS | 0x00000000 | |
| 09:18:01,276 | 452 | RegQueryValueExW |
Handle => 0x0000016e Data => 32 ValueName => DriveMask |
SUCCESS | 0x00000000 | |
| 09:18:01,276 | 452 | RegCloseKey |
Handle => 0x0000016e |
SUCCESS | 0x00000000 | |
| 09:18:01,276 | 452 | RegEnumKeyW |
Handle => 0x00000176 Name => {fbeb8a05-beee-4442-804e-409d6c4515e9} Index => 1 |
FAILURE | 0x00000103 | |
| 09:18:01,276 | 452 | RegCloseKey |
Handle => 0x00000176 |
SUCCESS | 0x00000000 | |
| 09:18:01,276 | 452 | NtCreateSection |
ObjectAttributes => DesiredAccess => 0x000f0007 SectionHandle => 0x00000174 FileHandle => 0x00000000 |
SUCCESS | 0x00000000 | |
| 09:18:01,276 | 452 | ZwMapViewOfSection |
SectionOffset => 0x0012ef60 SectionHandle => 0x00000174 ProcessHandle => 0xffffffff BaseAddress => 0x003b0000 |
SUCCESS | 0x00000000 | |
| 09:18:01,286 | 452 | ZwMapViewOfSection |
SectionOffset => 0x0012ef80 SectionHandle => 0x0000016c ProcessHandle => 0xffffffff BaseAddress => 0x003b0000 |
SUCCESS | 0x00000000 | |
| 09:18:01,286 | 452 | CreateDirectoryW |
DirectoryName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00000001 | |
| 09:18:01,286 | 452 | RegOpenKeyExW |
Handle => 0x0000016e Registry => 0x80000000 SubKey => Drive\shellex\FolderExtensions |
SUCCESS | 0x00000000 | |
| 09:18:01,286 | 452 | RegEnumKeyW |
Handle => 0x0000016e Name => {fbeb8a05-beee-4442-804e-409d6c4515e9} Index => 0 |
SUCCESS | 0x00000000 | |
| 09:18:01,286 | 452 | RegOpenKeyExW |
Handle => 0x00000176 Registry => 0x80000000 SubKey => Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9} |
SUCCESS | 0x00000000 | |
| 09:18:01,286 | 452 | RegQueryValueExW |
Handle => 0x00000176 Data => 32 ValueName => DriveMask |
SUCCESS | 0x00000000 | |
| 09:18:01,286 | 452 | RegCloseKey |
Handle => 0x00000176 |
SUCCESS | 0x00000000 | |
| 09:18:01,286 | 452 | RegEnumKeyW |
Handle => 0x0000016e Name => {fbeb8a05-beee-4442-804e-409d6c4515e9} Index => 1 |
FAILURE | 0x00000103 | |
| 09:18:01,286 | 452 | RegCloseKey |
Handle => 0x0000016e |
SUCCESS | 0x00000000 | |
| 09:18:01,286 | 452 | NtCreateSection |
ObjectAttributes => DesiredAccess => 0x000f0007 SectionHandle => 0x0000016c FileHandle => 0x00000000 |
SUCCESS | 0x00000000 | |
| 09:18:01,286 | 452 | ZwMapViewOfSection |
SectionOffset => 0x0012ef60 SectionHandle => 0x0000016c ProcessHandle => 0xffffffff BaseAddress => 0x003b0000 |
SUCCESS | 0x00000000 | |
| 09:18:01,286 | 452 | ZwMapViewOfSection |
SectionOffset => 0x0012ef80 SectionHandle => 0x00000174 ProcessHandle => 0xffffffff BaseAddress => 0x003b0000 |
SUCCESS | 0x00000000 | |
| 09:18:01,296 | 452 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x001ee1a8 | |
| 09:18:01,296 | 452 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x001ee1a8 | |
| 09:18:01,296 | 452 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x001ee1a8 | |
| 09:18:01,296 | 452 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x001ee1a8 | |
| 09:18:01,296 | 452 | CreateDirectoryW |
DirectoryName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0 |
FAILURE | 0x00000000 | |
| 09:18:01,296 | 452 | CreateDirectoryW |
DirectoryName => C:\Documents and Settings |
FAILURE | 0x00000000 | |
| 09:18:01,296 | 452 | CreateDirectoryW |
DirectoryName => C:\Documents and Settings\TDW |
FAILURE | 0x00000000 | |
| 09:18:01,296 | 452 | CreateDirectoryW |
DirectoryName => C:\Documents and Settings\TDW\Local Settings |
FAILURE | 0x00000000 | |
| 09:18:01,296 | 452 | CreateDirectoryW |
DirectoryName => C:\Documents and Settings\TDW\Local Settings\Application Data |
FAILURE | 0x00000000 | |
| 09:18:01,306 | 452 | CreateDirectoryW |
DirectoryName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe |
SUCCESS | 0x00000001 | |
| 09:18:01,306 | 452 | RegOpenKeyExW |
Handle => 0x00000176 Registry => 0x80000000 SubKey => Drive\shellex\FolderExtensions |
SUCCESS | 0x00000000 | |
| 09:18:01,306 | 452 | RegEnumKeyW |
Handle => 0x00000176 Name => {fbeb8a05-beee-4442-804e-409d6c4515e9} Index => 0 |
SUCCESS | 0x00000000 | |
| 09:18:01,306 | 452 | RegOpenKeyExW |
Handle => 0x0000016e Registry => 0x80000000 SubKey => Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9} |
SUCCESS | 0x00000000 | |
| 09:18:01,306 | 452 | RegQueryValueExW |
Handle => 0x0000016e Data => 32 ValueName => DriveMask |
SUCCESS | 0x00000000 | |
| 09:18:01,306 | 452 | RegCloseKey |
Handle => 0x0000016e |
SUCCESS | 0x00000000 | |
| 09:18:01,306 | 452 | RegEnumKeyW |
Handle => 0x00000176 Name => {fbeb8a05-beee-4442-804e-409d6c4515e9} Index => 1 |
FAILURE | 0x00000103 | |
| 09:18:01,306 | 452 | RegCloseKey |
Handle => 0x00000176 |
SUCCESS | 0x00000000 | |
| 09:18:01,306 | 452 | NtCreateSection |
ObjectAttributes => DesiredAccess => 0x000f0007 SectionHandle => 0x00000174 FileHandle => 0x00000000 |
SUCCESS | 0x00000000 | |
| 09:18:01,306 | 452 | ZwMapViewOfSection |
SectionOffset => 0x0012ef60 SectionHandle => 0x00000174 ProcessHandle => 0xffffffff BaseAddress => 0x003b0000 |
SUCCESS | 0x00000000 | |
| 09:18:01,306 | 452 | ZwMapViewOfSection |
SectionOffset => 0x0012ef80 SectionHandle => 0x0000016c ProcessHandle => 0xffffffff BaseAddress => 0x003b0000 |
SUCCESS | 0x00000000 | |
| 09:18:01,316 | 452 | CreateDirectoryW |
DirectoryName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat |
SUCCESS | 0x00000001 | |
| 09:18:01,316 | 452 | RegOpenKeyExW |
Handle => 0x0000016e Registry => 0x80000000 SubKey => Drive\shellex\FolderExtensions |
SUCCESS | 0x00000000 | |
| 09:18:01,316 | 452 | RegEnumKeyW |
Handle => 0x0000016e Name => {fbeb8a05-beee-4442-804e-409d6c4515e9} Index => 0 |
SUCCESS | 0x00000000 | |
| 09:18:01,316 | 452 | RegOpenKeyExW |
Handle => 0x00000176 Registry => 0x80000000 SubKey => Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9} |
SUCCESS | 0x00000000 | |
| 09:18:01,316 | 452 | RegQueryValueExW |
Handle => 0x00000176 Data => 32 ValueName => DriveMask |
SUCCESS | 0x00000000 | |
| 09:18:01,316 | 452 | RegCloseKey |
Handle => 0x00000176 |
SUCCESS | 0x00000000 | |
| 09:18:01,316 | 452 | RegEnumKeyW |
Handle => 0x0000016e Name => {fbeb8a05-beee-4442-804e-409d6c4515e9} Index => 1 |
FAILURE | 0x00000103 | |
| 09:18:01,316 | 452 | RegCloseKey |
Handle => 0x0000016e |
SUCCESS | 0x00000000 | |
| 09:18:01,316 | 452 | NtCreateSection |
ObjectAttributes => DesiredAccess => 0x000f0007 SectionHandle => 0x0000016c FileHandle => 0x00000000 |
SUCCESS | 0x00000000 | |
| 09:18:01,316 | 452 | ZwMapViewOfSection |
SectionOffset => 0x0012ef60 SectionHandle => 0x0000016c ProcessHandle => 0xffffffff BaseAddress => 0x003b0000 |
SUCCESS | 0x00000000 | |
| 09:18:01,316 | 452 | ZwMapViewOfSection |
SectionOffset => 0x0012ef80 SectionHandle => 0x00000174 ProcessHandle => 0xffffffff BaseAddress => 0x003b0000 |
SUCCESS | 0x00000000 | |
| 09:18:01,326 | 452 | CreateDirectoryW |
DirectoryName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00000001 | |
| 09:18:01,326 | 452 | RegOpenKeyExW |
Handle => 0x00000176 Registry => 0x80000000 SubKey => Drive\shellex\FolderExtensions |
SUCCESS | 0x00000000 | |
| 09:18:01,326 | 452 | RegEnumKeyW |
Handle => 0x00000176 Name => {fbeb8a05-beee-4442-804e-409d6c4515e9} Index => 0 |
SUCCESS | 0x00000000 | |
| 09:18:01,326 | 452 | RegOpenKeyExW |
Handle => 0x0000016e Registry => 0x80000000 SubKey => Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9} |
SUCCESS | 0x00000000 | |
| 09:18:01,326 | 452 | RegQueryValueExW |
Handle => 0x0000016e Data => 32 ValueName => DriveMask |
SUCCESS | 0x00000000 | |
| 09:18:01,326 | 452 | RegCloseKey |
Handle => 0x0000016e |
SUCCESS | 0x00000000 | |
| 09:18:01,326 | 452 | RegEnumKeyW |
Handle => 0x00000176 Name => {fbeb8a05-beee-4442-804e-409d6c4515e9} Index => 1 |
FAILURE | 0x00000103 | |
| 09:18:01,326 | 452 | RegCloseKey |
Handle => 0x00000176 |
SUCCESS | 0x00000000 | |
| 09:18:01,326 | 452 | NtCreateSection |
ObjectAttributes => DesiredAccess => 0x000f0007 SectionHandle => 0x00000174 FileHandle => 0x00000000 |
SUCCESS | 0x00000000 | |
| 09:18:01,326 | 452 | ZwMapViewOfSection |
SectionOffset => 0x0012ef60 SectionHandle => 0x00000174 ProcessHandle => 0xffffffff BaseAddress => 0x003b0000 |
SUCCESS | 0x00000000 | |
| 09:18:01,326 | 452 | ZwMapViewOfSection |
SectionOffset => 0x0012ef80 SectionHandle => 0x0000016c ProcessHandle => 0xffffffff BaseAddress => 0x003b0000 |
SUCCESS | 0x00000000 | |
| 09:18:01,336 | 452 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x001ee1a8 | |
| 09:18:01,336 | 452 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe |
SUCCESS | 0x001ee1a8 | |
| 09:18:01,336 | 452 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat |
SUCCESS | 0x001ee1a8 | |
| 09:18:01,336 | 452 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x001ee1a8 | |
| 09:18:01,336 | 452 | CreateDirectoryW |
DirectoryName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Color |
SUCCESS | 0x00000001 | |
| 09:18:01,336 | 452 | RegOpenKeyExW |
Handle => 0x0000016e Registry => 0x80000000 SubKey => Drive\shellex\FolderExtensions |
SUCCESS | 0x00000000 | |
| 09:18:01,336 | 452 | RegEnumKeyW |
Handle => 0x0000016e Name => {fbeb8a05-beee-4442-804e-409d6c4515e9} Index => 0 |
SUCCESS | 0x00000000 | |
| 09:18:01,336 | 452 | RegOpenKeyExW |
Handle => 0x00000176 Registry => 0x80000000 SubKey => Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9} |
SUCCESS | 0x00000000 | |
| 09:18:01,336 | 452 | RegQueryValueExW |
Handle => 0x00000176 Data => 32 ValueName => DriveMask |
SUCCESS | 0x00000000 | |
| 09:18:01,336 | 452 | RegCloseKey |
Handle => 0x00000176 |
SUCCESS | 0x00000000 | |
| 09:18:01,336 | 452 | RegEnumKeyW |
Handle => 0x0000016e Name => {fbeb8a05-beee-4442-804e-409d6c4515e9} Index => 1 |
FAILURE | 0x00000103 | |
| 09:18:01,336 | 452 | RegCloseKey |
Handle => 0x0000016e |
SUCCESS | 0x00000000 | |
| 09:18:01,336 | 452 | NtCreateSection |
ObjectAttributes => DesiredAccess => 0x000f0007 SectionHandle => 0x0000016c FileHandle => 0x00000000 |
SUCCESS | 0x00000000 | |
| 09:18:01,336 | 452 | ZwMapViewOfSection |
SectionOffset => 0x0012ef60 SectionHandle => 0x0000016c ProcessHandle => 0xffffffff BaseAddress => 0x003b0000 |
SUCCESS | 0x00000000 | |
| 09:18:01,336 | 452 | ZwMapViewOfSection |
SectionOffset => 0x0012ef80 SectionHandle => 0x00000174 ProcessHandle => 0xffffffff BaseAddress => 0x003b0000 |
SUCCESS | 0x00000000 | |
| 09:18:01,346 | 452 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x001ee1a8 | |
| 09:18:01,346 | 452 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe |
SUCCESS | 0x001ee1a8 | |
| 09:18:01,346 | 452 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Color |
SUCCESS | 0x001ee1a8 | |
| 09:18:01,346 | 452 | CreateDirectoryW |
DirectoryName => C:\Documents and Settings\TDW\Application Data\Adobe\Linguistics |
SUCCESS | 0x00000001 | |
| 09:18:01,346 | 452 | RegOpenKeyExW |
Handle => 0x00000176 Registry => 0x80000000 SubKey => Drive\shellex\FolderExtensions |
SUCCESS | 0x00000000 | |
| 09:18:01,346 | 452 | RegEnumKeyW |
Handle => 0x00000176 Name => {fbeb8a05-beee-4442-804e-409d6c4515e9} Index => 0 |
SUCCESS | 0x00000000 | |
| 09:18:01,346 | 452 | RegOpenKeyExW |
Handle => 0x0000016e Registry => 0x80000000 SubKey => Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9} |
SUCCESS | 0x00000000 | |
| 09:18:01,346 | 452 | RegQueryValueExW |
Handle => 0x0000016e Data => 32 ValueName => DriveMask |
SUCCESS | 0x00000000 | |
| 09:18:01,346 | 452 | RegCloseKey |
Handle => 0x0000016e |
SUCCESS | 0x00000000 | |
| 09:18:01,346 | 452 | RegEnumKeyW |
Handle => 0x00000176 Name => {fbeb8a05-beee-4442-804e-409d6c4515e9} Index => 1 |
FAILURE | 0x00000103 | |
| 09:18:01,346 | 452 | RegCloseKey |
Handle => 0x00000176 |
SUCCESS | 0x00000000 | |
| 09:18:01,356 | 452 | NtCreateSection |
ObjectAttributes => DesiredAccess => 0x000f0007 SectionHandle => 0x00000174 FileHandle => 0x00000000 |
SUCCESS | 0x00000000 | |
| 09:18:01,356 | 452 | ZwMapViewOfSection |
SectionOffset => 0x0012ef60 SectionHandle => 0x00000174 ProcessHandle => 0xffffffff BaseAddress => 0x003b0000 |
SUCCESS | 0x00000000 | |
| 09:18:01,356 | 452 | ZwMapViewOfSection |
SectionOffset => 0x0012ef80 SectionHandle => 0x0000016c ProcessHandle => 0xffffffff BaseAddress => 0x003b0000 |
SUCCESS | 0x00000000 | |
| 09:18:01,356 | 452 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x001ee1a8 | |
| 09:18:01,356 | 452 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x001ee1a8 | |
| 09:18:01,356 | 452 | CreateDirectoryW |
DirectoryName => C:\Documents and Settings\TDW\Application Data\Microsoft\Speech |
SUCCESS | 0x00000001 | |
| 09:18:01,356 | 452 | RegOpenKeyExW |
Handle => 0x0000016e Registry => 0x80000000 SubKey => Drive\shellex\FolderExtensions |
SUCCESS | 0x00000000 | |
| 09:18:01,366 | 452 | RegEnumKeyW |
Handle => 0x0000016e Name => {fbeb8a05-beee-4442-804e-409d6c4515e9} Index => 0 |
SUCCESS | 0x00000000 | |
| 09:18:01,366 | 452 | RegOpenKeyExW |
Handle => 0x00000176 Registry => 0x80000000 SubKey => Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9} |
SUCCESS | 0x00000000 | |
| 09:18:01,366 | 452 | RegQueryValueExW |
Handle => 0x00000176 Data => 32 ValueName => DriveMask |
SUCCESS | 0x00000000 | |
| 09:18:01,366 | 452 | RegCloseKey |
Handle => 0x00000176 |
SUCCESS | 0x00000000 | |
| 09:18:01,366 | 452 | RegEnumKeyW |
Handle => 0x0000016e Name => {fbeb8a05-beee-4442-804e-409d6c4515e9} Index => 1 |
FAILURE | 0x00000103 | |
| 09:18:01,366 | 452 | RegCloseKey |
Handle => 0x0000016e |
SUCCESS | 0x00000000 | |
| 09:18:01,366 | 452 | NtCreateSection |
ObjectAttributes => DesiredAccess => 0x000f0007 SectionHandle => 0x0000016c FileHandle => 0x00000000 |
SUCCESS | 0x00000000 | |
| 09:18:01,366 | 452 | ZwMapViewOfSection |
SectionOffset => 0x0012ef60 SectionHandle => 0x0000016c ProcessHandle => 0xffffffff BaseAddress => 0x003b0000 |
SUCCESS | 0x00000000 | |
| 09:18:01,366 | 452 | ZwMapViewOfSection |
SectionOffset => 0x0012ef80 SectionHandle => 0x00000174 ProcessHandle => 0xffffffff BaseAddress => 0x003b0000 |
SUCCESS | 0x00000000 | |
| 09:18:01,366 | 452 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x001ee1a8 | |
| 09:18:01,376 | 452 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Microsoft\Speech |
SUCCESS | 0x001ee1a8 | |
| 09:18:01,376 | 452 | CreateDirectoryW |
DirectoryName => C:\Documents and Settings\TDW\Application Data\Adobe\LogTransport2 |
SUCCESS | 0x00000001 | |
| 09:18:01,376 | 452 | RegOpenKeyExW |
Handle => 0x00000176 Registry => 0x80000000 SubKey => Drive\shellex\FolderExtensions |
SUCCESS | 0x00000000 | |
| 09:18:01,376 | 452 | RegEnumKeyW |
Handle => 0x00000176 Name => {fbeb8a05-beee-4442-804e-409d6c4515e9} Index => 0 |
SUCCESS | 0x00000000 | |
| 09:18:01,376 | 452 | RegOpenKeyExW |
Handle => 0x0000016e Registry => 0x80000000 SubKey => Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9} |
SUCCESS | 0x00000000 | |
| 09:18:01,376 | 452 | RegQueryValueExW |
Handle => 0x0000016e Data => 32 ValueName => DriveMask |
SUCCESS | 0x00000000 | |
| 09:18:01,376 | 452 | RegCloseKey |
Handle => 0x0000016e |
SUCCESS | 0x00000000 | |
| 09:18:01,376 | 452 | RegEnumKeyW |
Handle => 0x00000176 Name => {fbeb8a05-beee-4442-804e-409d6c4515e9} Index => 1 |
FAILURE | 0x00000103 | |
| 09:18:01,376 | 452 | RegCloseKey |
Handle => 0x00000176 |
SUCCESS | 0x00000000 | |
| 09:18:01,376 | 452 | NtCreateSection |
ObjectAttributes => DesiredAccess => 0x000f0007 SectionHandle => 0x00000174 FileHandle => 0x00000000 |
SUCCESS | 0x00000000 | |
| 09:18:01,376 | 452 | ZwMapViewOfSection |
SectionOffset => 0x0012ef60 SectionHandle => 0x00000174 ProcessHandle => 0xffffffff BaseAddress => 0x003b0000 |
SUCCESS | 0x00000000 | |
| 09:18:01,376 | 452 | ZwMapViewOfSection |
SectionOffset => 0x0012ef80 SectionHandle => 0x0000016c ProcessHandle => 0xffffffff BaseAddress => 0x003b0000 |
SUCCESS | 0x00000000 | |
| 09:18:01,386 | 452 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x001ee1a8 | |
| 09:18:01,386 | 452 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x001ee1a8 | |
| 09:18:01,406 | 452 | CreateDirectoryW |
DirectoryName => C:\Documents and Settings\TDW\Application Data\Adobe\Headlights |
SUCCESS | 0x00000001 | |
| 09:18:01,406 | 452 | RegOpenKeyExW |
Handle => 0x0000016e Registry => 0x80000000 SubKey => Drive\shellex\FolderExtensions |
SUCCESS | 0x00000000 | |
| 09:18:01,406 | 452 | RegEnumKeyW |
Handle => 0x0000016e Name => {fbeb8a05-beee-4442-804e-409d6c4515e9} Index => 0 |
SUCCESS | 0x00000000 | |
| 09:18:01,406 | 452 | RegOpenKeyExW |
Handle => 0x00000176 Registry => 0x80000000 SubKey => Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9} |
SUCCESS | 0x00000000 | |
| 09:18:01,406 | 452 | RegQueryValueExW |
Handle => 0x00000176 Data => 32 ValueName => DriveMask |
SUCCESS | 0x00000000 | |
| 09:18:01,406 | 452 | RegCloseKey |
Handle => 0x00000176 |
SUCCESS | 0x00000000 | |
| 09:18:01,406 | 452 | RegEnumKeyW |
Handle => 0x0000016e Name => {fbeb8a05-beee-4442-804e-409d6c4515e9} Index => 1 |
FAILURE | 0x00000103 | |
| 09:18:01,406 | 452 | RegCloseKey |
Handle => 0x0000016e |
SUCCESS | 0x00000000 | |
| 09:18:01,406 | 452 | NtCreateSection |
ObjectAttributes => DesiredAccess => 0x000f0007 SectionHandle => 0x0000016c FileHandle => 0x00000000 |
SUCCESS | 0x00000000 | |
| 09:18:01,406 | 452 | ZwMapViewOfSection |
SectionOffset => 0x0012ef60 SectionHandle => 0x0000016c ProcessHandle => 0xffffffff BaseAddress => 0x003b0000 |
SUCCESS | 0x00000000 | |
| 09:18:01,416 | 452 | ZwMapViewOfSection |
SectionOffset => 0x0012ef80 SectionHandle => 0x00000174 ProcessHandle => 0xffffffff BaseAddress => 0x003b0000 |
SUCCESS | 0x00000000 | |
| 09:18:01,416 | 452 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x001ee1a8 | |
| 09:18:01,416 | 452 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x001ee1a8 | |
| 09:18:01,416 | 452 | CreateDirectoryW |
DirectoryName => C:\Documents and Settings\TDW\Application Data\Adobe\Flash Player\AssetCache |
FAILURE | 0x00000000 | |
| 09:18:01,416 | 452 | CreateDirectoryW |
DirectoryName => C:\Documents and Settings |
FAILURE | 0x00000000 | |
| 09:18:01,416 | 452 | CreateDirectoryW |
DirectoryName => C:\Documents and Settings\TDW |
FAILURE | 0x00000000 | |
| 09:18:01,416 | 452 | CreateDirectoryW |
DirectoryName => C:\Documents and Settings\TDW\Application Data |
FAILURE | 0x00000000 | |
| 09:18:01,416 | 452 | CreateDirectoryW |
DirectoryName => C:\Documents and Settings\TDW\Application Data\Adobe |
FAILURE | 0x00000000 | |
| 09:18:01,416 | 452 | CreateDirectoryW |
DirectoryName => C:\Documents and Settings\TDW\Application Data\Adobe\Flash Player |
SUCCESS | 0x00000001 | |
| 09:18:01,416 | 452 | RegOpenKeyExW |
Handle => 0x00000176 Registry => 0x80000000 SubKey => Drive\shellex\FolderExtensions |
SUCCESS | 0x00000000 | |
| 09:18:01,416 | 452 | RegEnumKeyW |
Handle => 0x00000176 Name => {fbeb8a05-beee-4442-804e-409d6c4515e9} Index => 0 |
SUCCESS | 0x00000000 | |
| 09:18:01,416 | 452 | RegOpenKeyExW |
Handle => 0x0000016e Registry => 0x80000000 SubKey => Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9} |
SUCCESS | 0x00000000 | |
| 09:18:01,416 | 452 | RegQueryValueExW |
Handle => 0x0000016e Data => 32 ValueName => DriveMask |
SUCCESS | 0x00000000 | |
| 09:18:01,426 | 452 | RegCloseKey |
Handle => 0x0000016e |
SUCCESS | 0x00000000 | |
| 09:18:01,426 | 452 | RegEnumKeyW |
Handle => 0x00000176 Name => {fbeb8a05-beee-4442-804e-409d6c4515e9} Index => 1 |
FAILURE | 0x00000103 | |
| 09:18:01,426 | 452 | RegCloseKey |
Handle => 0x00000176 |
SUCCESS | 0x00000000 | |
| 09:18:01,426 | 452 | NtCreateSection |
ObjectAttributes => DesiredAccess => 0x000f0007 SectionHandle => 0x00000174 FileHandle => 0x00000000 |
SUCCESS | 0x00000000 | |
| 09:18:01,426 | 452 | ZwMapViewOfSection |
SectionOffset => 0x0012ef60 SectionHandle => 0x00000174 ProcessHandle => 0xffffffff BaseAddress => 0x003b0000 |
SUCCESS | 0x00000000 | |
| 09:18:01,426 | 452 | ZwMapViewOfSection |
SectionOffset => 0x0012ef80 SectionHandle => 0x0000016c ProcessHandle => 0xffffffff BaseAddress => 0x003b0000 |
SUCCESS | 0x00000000 | |
| 09:18:01,426 | 452 | CreateDirectoryW |
DirectoryName => C:\Documents and Settings\TDW\Application Data\Adobe\Flash Player\AssetCache |
SUCCESS | 0x00000001 | |
| 09:18:01,426 | 452 | RegOpenKeyExW |
Handle => 0x0000016e Registry => 0x80000000 SubKey => Drive\shellex\FolderExtensions |
SUCCESS | 0x00000000 | |
| 09:18:01,426 | 452 | RegEnumKeyW |
Handle => 0x0000016e Name => {fbeb8a05-beee-4442-804e-409d6c4515e9} Index => 0 |
SUCCESS | 0x00000000 | |
| 09:18:01,426 | 452 | RegOpenKeyExW |
Handle => 0x00000176 Registry => 0x80000000 SubKey => Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9} |
SUCCESS | 0x00000000 | |
| 09:18:01,426 | 452 | RegQueryValueExW |
Handle => 0x00000176 Data => 32 ValueName => DriveMask |
SUCCESS | 0x00000000 | |
| 09:18:01,426 | 452 | RegCloseKey |
Handle => 0x00000176 |
SUCCESS | 0x00000000 | |
| 09:18:01,426 | 452 | RegEnumKeyW |
Handle => 0x0000016e Name => {fbeb8a05-beee-4442-804e-409d6c4515e9} Index => 1 |
FAILURE | 0x00000103 | |
| 09:18:01,426 | 452 | RegCloseKey |
Handle => 0x0000016e |
SUCCESS | 0x00000000 | |
| 09:18:01,426 | 452 | NtCreateSection |
ObjectAttributes => DesiredAccess => 0x000f0007 SectionHandle => 0x0000016c FileHandle => 0x00000000 |
SUCCESS | 0x00000000 | |
| 09:18:01,426 | 452 | ZwMapViewOfSection |
SectionOffset => 0x0012ef60 SectionHandle => 0x0000016c ProcessHandle => 0xffffffff BaseAddress => 0x003b0000 |
SUCCESS | 0x00000000 | |
| 09:18:01,436 | 452 | ZwMapViewOfSection |
SectionOffset => 0x0012ef80 SectionHandle => 0x00000174 ProcessHandle => 0xffffffff BaseAddress => 0x003b0000 |
SUCCESS | 0x00000000 | |
| 09:18:01,436 | 452 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x001ee1a8 | |
| 09:18:01,436 | 452 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x001ee1a8 | |
| 09:18:01,436 | 452 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x001ee1a8 | 3 times |
| 09:18:01,436 | 452 | RegCreateKeyExW |
Handle => 0x00000174 Access => 33554432 Registry => 0x80000001 Class => SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders |
SUCCESS | 0x00000000 | |
| 09:18:01,436 | 452 | RegQueryValueExW |
Handle => 0x00000174 Data => %\x00U\x00S\x00E\x00R\x00P\x00R\x00O\x00F\x00I\x00L\x00E\x00%\x00\\x00M\x00y\x00 \x00D\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00s\x00\x00\x00 ValueName => Personal |
SUCCESS | 0x00000000 | |
| 09:18:01,436 | 452 | RegCloseKey |
Handle => 0x00000174 |
SUCCESS | 0x00000000 | |
| 09:18:01,436 | 452 | RegCreateKeyExW |
Handle => 0x00000174 Access => 33554432 Registry => 0x80000001 Class => SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders |
SUCCESS | 0x00000000 | |
| 09:18:01,436 | 452 | RegSetValueExW |
Handle => 0x00000174 Buffer => C\x00:\x00\\x00D\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00s\x00 \x00a\x00n\x00d\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00D\x00W\x00\\x00M\x00y\x00 \x00D\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00s\x00\x00\x00 ValueName => Personal Type => 1 |
SUCCESS | 0x00000000 | |
| 09:18:01,436 | 452 | RegCloseKey |
Handle => 0x00000174 |
SUCCESS | 0x00000000 | |
| 09:18:01,446 | 452 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x001ee1a8 | |
| 09:18:01,446 | 452 | RegCreateKeyExW |
Handle => 0x00000174 Access => 33554432 Registry => 0x80000001 Class => SubKey => |
SUCCESS | 0x00000000 | |
| 09:18:01,446 | 452 | LdrGetDllHandle |
ModuleHandle => 0x7c900000 FileName => ntdll.dll |
SUCCESS | 0x00000000 | |
| 09:18:01,446 | 452 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => NtQueryObject FunctionAddress => 0x7c90d870 ModuleHandle => 0x7c900000 |
SUCCESS | 0x00000000 | |
| 09:18:01,446 | 452 | RegCloseKey |
Handle => 0x00000174 |
SUCCESS | 0x00000000 | |
| 09:18:01,446 | 452 | RegCreateKeyExW |
Handle => 0x00000174 Access => 33554432 Registry => 0x80000001 Class => SubKey => |
SUCCESS | 0x00000000 | |
| 09:18:01,446 | 452 | RegCloseKey |
Handle => 0x00000174 |
SUCCESS | 0x00000000 | |
| 09:18:01,446 | 452 | RegCreateKeyExW |
Handle => 0x00000174 Access => 33554432 Registry => 0x80000001 Class => SubKey => |
SUCCESS | 0x00000000 | |
| 09:18:01,446 | 452 | RegCloseKey |
Handle => 0x00000174 |
SUCCESS | 0x00000000 | |
| 09:18:01,446 | 452 | RegCreateKeyExW |
Handle => 0x00000174 Access => 33554432 Registry => 0x80000001 Class => SubKey => |
SUCCESS | 0x00000000 | |
| 09:18:01,446 | 452 | RegCloseKey |
Handle => 0x00000174 |
SUCCESS | 0x00000000 | |
| 09:18:01,446 | 452 | RegCreateKeyExW |
Handle => 0x00000174 Access => 33554432 Registry => 0x80000001 Class => SubKey => |
SUCCESS | 0x00000000 | |
| 09:18:01,446 | 452 | RegCloseKey |
Handle => 0x00000174 |
SUCCESS | 0x00000000 | |
| 09:18:01,446 | 452 | RegCreateKeyExW |
Handle => 0x00000174 Access => 33554432 Registry => 0x80000001 Class => SubKey => |
SUCCESS | 0x00000000 | |
| 09:18:01,446 | 452 | RegCloseKey |
Handle => 0x00000174 |
SUCCESS | 0x00000000 | |
| 09:18:01,446 | 452 | RegCreateKeyExW |
Handle => 0x00000174 Access => 33554432 Registry => 0x80000001 Class => SubKey => |
SUCCESS | 0x00000000 | |
| 09:18:01,446 | 452 | RegCloseKey |
Handle => 0x00000174 |
SUCCESS | 0x00000000 | |
| 09:18:01,446 | 452 | RegCreateKeyExW |
Handle => 0x00000174 Access => 33554432 Registry => 0x80000001 Class => SubKey => |
SUCCESS | 0x00000000 | |
| 09:18:01,446 | 452 | RegCloseKey |
Handle => 0x00000174 |
SUCCESS | 0x00000000 | |
| 09:18:01,446 | 452 | RegCreateKeyExW |
Handle => 0x00000174 Access => 33554432 Registry => 0x80000001 Class => SubKey => |
SUCCESS | 0x00000000 | |
| 09:18:01,446 | 452 | RegCloseKey |
Handle => 0x00000174 |
SUCCESS | 0x00000000 | |
| 09:18:01,446 | 452 | RegCreateKeyExW |
Handle => 0x00000174 Access => 33554432 Registry => 0x80000001 Class => SubKey => |
SUCCESS | 0x00000000 | |
| 09:18:01,446 | 452 | RegCloseKey |
Handle => 0x00000174 |
SUCCESS | 0x00000000 | |
| 09:18:01,446 | 452 | RegCreateKeyExW |
Handle => 0x0000016e Access => 33554432 Registry => 0x80000000 Class => SubKey => |
SUCCESS | 0x00000000 | |
| 09:18:01,446 | 452 | RegCloseKey |
Handle => 0x0000016e |
SUCCESS | 0x00000000 | |
| 09:18:01,446 | 452 | RegCreateKeyExW |
Handle => 0x0000016c Access => 33554432 Registry => 0x80000001 Class => SubKey => |
SUCCESS | 0x00000000 | |
| 09:18:01,446 | 452 | RegCloseKey |
Handle => 0x0000016c |
SUCCESS | 0x00000000 | |
| 09:18:01,446 | 452 | RegCreateKeyExW |
Handle => 0x0000016c Access => 33554432 Registry => 0x80000002 Class => SubKey => |
SUCCESS | 0x00000000 | |
| 09:18:01,446 | 452 | RegCloseKey |
Handle => 0x0000016c |
SUCCESS | 0x00000000 | |
| 09:18:01,446 | 452 | RegCreateKeyExW |
Handle => 0x00000174 Access => 33554432 Registry => 0x80000003 Class => SubKey => |
SUCCESS | 0x00000000 | |
| 09:18:01,446 | 452 | RegCloseKey |
Handle => 0x00000174 |
SUCCESS | 0x00000000 | |
| 09:18:01,446 | 452 | RegCreateKeyExW |
Handle => 0x00000178 Access => 33554432 Registry => 0x80000005 Class => SubKey => |
SUCCESS | 0x00000000 | |
| 09:18:01,446 | 452 | RegCloseKey |
Handle => 0x00000178 |
SUCCESS | 0x00000000 | |
| 09:18:01,446 | 452 | RegCreateKeyExW |
Handle => 0x0000017c Access => 983103 Registry => 0x80000001 Class => SubKey => Software\Adobe\Adobe Acrobat\11.0 |
SUCCESS | 0x00000000 | |
| 09:18:01,446 | 452 | RegCreateKeyExW |
Handle => 0x00000178 Access => 33554432 Registry => 0x80000001 Class => SubKey => |
SUCCESS | 0x00000000 | |
| 09:18:01,446 | 452 | RegCloseKey |
Handle => 0x00000178 |
SUCCESS | 0x00000000 | |
| 09:18:01,446 | 452 | RegCreateKeyExW |
Handle => 0x00000178 Access => 33554432 Registry => 0x80000001 Class => SubKey => |
SUCCESS | 0x00000000 | |
| 09:18:01,446 | 452 | RegCloseKey |
Handle => 0x00000178 |
SUCCESS | 0x00000000 | |
| 09:18:01,446 | 452 | RegCreateKeyExW |
Handle => 0x00000178 Access => 983103 Registry => 0x80000001 Class => SubKey => Software\Adobe\Acrobat Reader\11.0 |
SUCCESS | 0x00000000 | |
| 09:18:01,446 | 452 | RegCreateKeyExW |
Handle => 0x00000180 Access => 33554432 Registry => 0x80000001 Class => SubKey => |
SUCCESS | 0x00000000 | |
| 09:18:01,446 | 452 | RegCloseKey |
Handle => 0x00000180 |
SUCCESS | 0x00000000 | |
| 09:18:01,446 | 452 | RegCreateKeyExW |
Handle => 0x00000180 Access => 33554432 Registry => 0x80000001 Class => SubKey => |
SUCCESS | 0x00000000 | |
| 09:18:01,446 | 452 | RegCloseKey |
Handle => 0x00000180 |
SUCCESS | 0x00000000 | |
| 09:18:01,456 | 452 | RegCreateKeyExW |
Handle => 0x00000184 Access => 983103 Registry => 0x80000001 Class => SubKey => Software\Adobe\Adobe Synchronizer\11.0 |
SUCCESS | 0x00000000 | |
| 09:18:01,456 | 452 | RegCreateKeyExW |
Handle => 0x00000180 Access => 33554432 Registry => 0x80000001 Class => SubKey => |
SUCCESS | 0x00000000 | |
| 09:18:01,456 | 452 | RegCloseKey |
Handle => 0x00000180 |
SUCCESS | 0x00000000 | |
| 09:18:01,456 | 452 | RegCreateKeyExW |
Handle => 0x00000180 Access => 33554432 Registry => 0x80000001 Class => SubKey => |
SUCCESS | 0x00000000 | |
| 09:18:01,456 | 452 | RegCloseKey |
Handle => 0x00000180 |
SUCCESS | 0x00000000 | |
| 09:18:01,456 | 452 | RegCreateKeyExW |
Handle => 0x00000180 Access => 983103 Registry => 0x80000001 Class => SubKey => Software\Adobe\CommonFiles\Usage\Reader 11 |
SUCCESS | 0x00000000 | |
| 09:18:01,456 | 452 | RegCreateKeyExW |
Handle => 0x00000188 Access => 33554432 Registry => 0x80000001 Class => SubKey => |
SUCCESS | 0x00000000 | |
| 09:18:01,456 | 452 | RegCloseKey |
Handle => 0x00000188 |
SUCCESS | 0x00000000 | |
| 09:18:01,456 | 452 | RegCreateKeyExW |
Handle => 0x00000188 Access => 33554432 Registry => 0x80000001 Class => SubKey => |
SUCCESS | 0x00000000 | |
| 09:18:01,456 | 452 | RegCloseKey |
Handle => 0x00000188 |
SUCCESS | 0x00000000 | |
| 09:18:01,456 | 452 | RegCreateKeyExW |
Handle => 0x00000188 Access => 33554432 Registry => 0x80000001 Class => SubKey => |
SUCCESS | 0x00000000 | |
| 09:18:01,456 | 452 | RegCloseKey |
Handle => 0x00000188 |
SUCCESS | 0x00000000 | |
| 09:18:01,456 | 452 | RegCreateKeyExW |
Handle => 0x00000188 Access => 33554432 Registry => 0x80000001 Class => SubKey => |
SUCCESS | 0x00000000 | |
| 09:18:01,456 | 452 | RegCloseKey |
Handle => 0x00000188 |
SUCCESS | 0x00000000 | |
| 09:18:01,456 | 452 | RegCreateKeyExW |
Handle => 0x00000188 Access => 33554432 Registry => 0x80000001 Class => SubKey => |
SUCCESS | 0x00000000 | |
| 09:18:01,456 | 452 | RegCloseKey |
Handle => 0x00000188 |
SUCCESS | 0x00000000 | |
| 09:18:01,456 | 452 | RegCreateKeyExW |
Handle => 0x00000188 Access => 33554432 Registry => 0x80000001 Class => SubKey => |
SUCCESS | 0x00000000 | |
| 09:18:01,456 | 452 | RegCloseKey |
Handle => 0x00000188 |
SUCCESS | 0x00000000 | |
| 09:18:01,456 | 452 | RegCreateKeyExW |
Handle => 0x00000188 Access => 33554432 Registry => 0x80000001 Class => SubKey => |
SUCCESS | 0x00000000 | |
| 09:18:01,456 | 452 | RegCloseKey |
Handle => 0x00000188 |
SUCCESS | 0x00000000 | |
| 09:18:01,456 | 452 | RegCreateKeyExW |
Handle => 0x00000188 Access => 33554432 Registry => 0x80000001 Class => SubKey => |
SUCCESS | 0x00000000 | |
| 09:18:01,466 | 452 | RegCloseKey |
Handle => 0x00000188 |
SUCCESS | 0x00000000 | |
| 09:18:01,466 | 452 | RegCreateKeyExW |
Handle => 0x00000188 Access => 33554432 Registry => 0x80000001 Class => SubKey => |
SUCCESS | 0x00000000 | |
| 09:18:01,466 | 452 | RegCloseKey |
Handle => 0x00000188 |
SUCCESS | 0x00000000 | |
| 09:18:01,466 | 452 | RegCreateKeyExW |
Handle => 0x00000188 Access => 33554432 Registry => 0x80000001 Class => SubKey => |
SUCCESS | 0x00000000 | |
| 09:18:01,466 | 452 | RegCloseKey |
Handle => 0x00000188 |
SUCCESS | 0x00000000 | |
| 09:18:01,466 | 452 | RegCreateKeyExW |
Handle => 0x00000188 Access => 33554432 Registry => 0x80000001 Class => SubKey => |
SUCCESS | 0x00000000 | |
| 09:18:01,466 | 452 | RegCloseKey |
Handle => 0x00000188 |
SUCCESS | 0x00000000 | |
| 09:18:01,466 | 452 | RegCreateKeyExW |
Handle => 0x00000188 Access => 33554432 Registry => 0x80000001 Class => SubKey => |
SUCCESS | 0x00000000 | |
| 09:18:01,466 | 452 | RegCloseKey |
Handle => 0x00000188 |
SUCCESS | 0x00000000 | |
| 09:18:01,466 | 452 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => SOFTWARE\Justsystem\ATOK\Setup\Folder |
FAILURE | 0x00000002 | |
| 09:18:01,466 | 452 | RegQueryValueExW |
Handle => 0x00000000 DataLength => 0 ValueName => Atok23 Type => 1 |
FAILURE | 0x00000006 | |
| 09:18:01,466 | 452 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => SOFTWARE\Justsystem\ATOK\Setup\Folder |
FAILURE | 0x00000002 | |
| 09:18:01,466 | 452 | RegQueryValueExW |
Handle => 0x00000000 DataLength => 0 ValueName => Atok24 Type => 1 |
FAILURE | 0x00000006 | |
| 09:18:01,466 | 452 | NtCreateMutant |
Handle => 0x00000188 InitialOwner => 0 MutexName => {100184D2-BDC3-477a-B8D3-65548B67914C}_448 |
SUCCESS | 0x00000000 | |
| 09:18:01,476 | 452 | LookupPrivilegeValueW |
SystemName => PrivilegeName => SeChangeNotifyPrivilege |
SUCCESS | 0x00000001 | 19 times |
| 09:18:01,516 | 452 | FindWindowW |
ClassName => 0 WindowName => _AcroAppTimer |
FAILURE | 0x00000000 | |
| 09:18:01,516 | 452 | FindWindowW |
ClassName => 0 WindowName => SafeNet Borderless Single Sign On..... |
FAILURE | 0x00000000 | |
| 09:18:01,516 | 452 | LdrLoadDll |
Flags => 1241956 BaseAddress => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:18:01,516 | 452 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CreateProcessInternalWSecure FunctionAddress => 0x7c8806f8 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:18:01,536 | 452 | CreateProcessInternalW |
ApplicationName => C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe ProcessId => 1304 CommandLine => "C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe" --channel=448.0.1014188428 --type=renderer "C:\DOCUME~1\TDW\LOCALS~1\Temp\sep14tax-c8.pdf" ThreadHandle => 0x000001b4 ProcessHandle => 0x000001b0 ThreadId => 1276 CreationFlags => 0x0100040c |
SUCCESS | 0x00000001 | |
| 09:18:01,536 | 452 | NtGetContextThread |
ThreadHandle => 0x000001b4 |
SUCCESS | 0x00000000 | |
| 09:18:01,536 | 452 | WriteProcessMemory |
Buffer => \x04\x00\x00\x00 ProcessHandle => 0x000001b0 BaseAddress => 0x0053e3c0 |
SUCCESS | 0x00000001 | |
| 09:18:01,536 | 452 | WriteProcessMemory |
Buffer => \x08\x00\x00\x00 ProcessHandle => 0x000001b0 BaseAddress => 0x0053e3c4 |
SUCCESS | 0x00000001 | |
| 09:18:01,536 | 452 | WriteProcessMemory |
Buffer => \xfc\x04\x00\x00 ProcessHandle => 0x000001b0 BaseAddress => 0x0053f428 |
SUCCESS | 0x00000001 | |
| 09:18:01,536 | 452 | WriteProcessMemory |
Buffer => \x00 ProcessHandle => 0x000001b0 BaseAddress => 0x0053e3b3 |
SUCCESS | 0x00000001 | |
| 09:18:01,536 | 452 | WriteProcessMemory |
Buffer => \x00 ProcessHandle => 0x000001b0 BaseAddress => 0x0053e3b2 |
SUCCESS | 0x00000001 | |
| 09:18:01,536 | 452 | LdrGetDllHandle |
ModuleHandle => 0x7c900000 FileName => ntdll.dll |
SUCCESS | 0x00000000 | |
| 09:18:01,546 | 452 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => NtOpenKeyEx FunctionAddress => 0x00502a70 ModuleHandle => 0x7c900000 |
FAILURE | 3221225785 | |
| 09:18:01,546 | 452 | RegOpenKeyExW |
Handle => 0x000001a4 Registry => 0x80000002 SubKey => Software\Policies\Adobe\Acrobat Reader\11.0\FeatureLockDown |
SUCCESS | 0x00000000 | |
| 09:18:01,546 | 452 | RegQueryValueExW |
Handle => 0x000001a4 DataLength => 4 ValueName => bDisableCryptBroker Type => 1242944 |
FAILURE | 0x00000002 | |
| 09:18:01,546 | 452 | RegCloseKey |
Handle => 0x000001a4 |
SUCCESS | 0x00000000 | |
| 09:18:01,546 | 452 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => dgapi.dll |
FAILURE | 3221225781 | 1 time |
| 09:18:01,546 | 452 | LdrGetDllHandle |
ModuleHandle => 0x7c900000 FileName => ntdll.dll |
SUCCESS | 0x00000000 | |
| 09:18:01,546 | 452 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => NtAddAtomEx FunctionAddress => 0x0051c138 ModuleHandle => 0x7c900000 |
FAILURE | 3221225785 | |
| 09:18:01,546 | 452 | WriteProcessMemory |
Buffer => \x0c\x00\x00\x00\x00\x00\x00\x00\xa8\x00\x00\x00(\x00\x00\x00\x04\x00\x00\x00\x00\x00k\x00e\x00r\x00n\x00e\x00l\x003\x002\x00.\x00d\x00l\x00l\x00\x00\x00 \x00\x00\x00\x03\x00\x00\x00\x0f\x00\x00\x00\xd0FF\x00CreateProcessW\x00\x00 \x00\x00\x00\x03\x00\x00\x00\x10\x00\x00\x00PHF\x00CreateProcessA\x00\x00 \x00\x00\x00\x02\x00\x00\x00^\x00\x00\x000vN\x00MoveFileExW\x00\x00\x00\x00\x00 \x00\x00\x00\x03\x00\x00\x00!\x01\x00\x00@\x9aA\x00CreateThread\x00\x00\x00\x00T\x04\x00\x00(\x00\x00\x00\x1a\x00\x00\x00\x00\x00C\x00r\x00y\x00p\x00t\x003\x002\x00.\x00d\x00l\x00l\x00\x00\x00\x00\x00$\x00\x00\x00\x02\x00\x00\x00)\x00\x00\x00P\x9fN\x00CryptProtectData\x00\x00\x00\x00(\x00\x00\x00 ProcessHandle => 0x000001b0 BaseAddress => 0x00a00000 |
SUCCESS | 0x00000001 | |
| 09:18:01,546 | 452 | LdrGetDllHandle |
ModuleHandle => 0x7c900000 FileName => ntdll.dll |
SUCCESS | 0x00000000 | |
| 09:18:01,546 | 452 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:18:01,546 | 452 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:18:01,556 | 452 | ReadProcessMemory |
Buffer => \xb8%\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2,\x00\x90 ProcessHandle => 0x000001b0 BaseAddress => 0x7c90d090 |
SUCCESS | 0x00000001 | |
| 09:18:01,556 | 452 | ReadProcessMemory |
Buffer => \xf0\xe4\x90| ProcessHandle => 0x000001b0 BaseAddress => 0x7ffe0300 |
SUCCESS | 0x00000001 | |
| 09:18:01,556 | 452 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:18:01,556 | 452 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:18:01,556 | 452 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:18:01,556 | 452 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:18:01,556 | 452 | WriteProcessMemory |
Buffer => \xb8%\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2,\x00\x90\x00\x00\x00\x00\x00\x00\x00\x00\x83\xec\x08R\x8bT$\x0c\x89T$\x08\xc7D$\x0c\x10\xb8\xa1\x00\xc7D$\x04\x10+A\x00Z\xc3 ProcessHandle => 0x000001b0 BaseAddress => 0x00a1b810 |
SUCCESS | 0x00000001 | |
| 09:18:01,556 | 452 | VirtualProtectEx |
Protection => 0x00000008 ProcessHandle => 0x000001b0 Address => 0x7c90d090 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:18:01,556 | 452 | WriteProcessMemory |
Buffer => \xb8%\x00\x00\x00\xba(\xb8\xa1\x00\xff\xe2 ProcessHandle => 0x000001b0 BaseAddress => 0x7c90d090 |
SUCCESS | 0x00000001 | |
| 09:18:01,556 | 452 | VirtualProtectEx |
Protection => 0x00000020 ProcessHandle => 0x000001b0 Address => 0x7c90d090 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:18:01,556 | 452 | ReadProcessMemory |
Buffer => \xb8t\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x18\x00\x90 ProcessHandle => 0x000001b0 BaseAddress => 0x7c90d580 |
SUCCESS | 0x00000001 | |
| 09:18:01,556 | 452 | ReadProcessMemory |
Buffer => \xf0\xe4\x90| ProcessHandle => 0x000001b0 BaseAddress => 0x7ffe0300 |
SUCCESS | 0x00000001 | |
| 09:18:01,556 | 452 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:18:01,556 | 452 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:18:01,556 | 452 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:18:01,556 | 452 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:18:01,556 | 452 | WriteProcessMemory |
Buffer => \xb8t\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x18\x00\x90\x00\x00\x00\x00\x00\x00\x00\x00\x83\xec\x08R\x8bT$\x0c\x89T$\x08\xc7D$\x0cP\xb8\xa1\x00\xc7D$\x04P\x10@\x00Z\xc3 ProcessHandle => 0x000001b0 BaseAddress => 0x00a1b850 |
SUCCESS | 0x00000001 | |
| 09:18:01,556 | 452 | VirtualProtectEx |
Protection => 0x00000008 ProcessHandle => 0x000001b0 Address => 0x7c90d580 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:18:01,556 | 452 | WriteProcessMemory |
Buffer => \xb8t\x00\x00\x00\xbah\xb8\xa1\x00\xff\xe2 ProcessHandle => 0x000001b0 BaseAddress => 0x7c90d580 |
SUCCESS | 0x00000001 | |
| 09:18:01,566 | 452 | VirtualProtectEx |
Protection => 0x00000020 ProcessHandle => 0x000001b0 Address => 0x7c90d580 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:18:01,566 | 452 | ReadProcessMemory |
Buffer => \xb8\x8b\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x08\x00\x90 ProcessHandle => 0x000001b0 BaseAddress => 0x7c90d6f0 |
SUCCESS | 0x00000001 | |
| 09:18:01,566 | 452 | ReadProcessMemory |
Buffer => \xf0\xe4\x90| ProcessHandle => 0x000001b0 BaseAddress => 0x7ffe0300 |
SUCCESS | 0x00000001 | |
| 09:18:01,566 | 452 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:18:01,566 | 452 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:18:01,566 | 452 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:18:01,566 | 452 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:18:01,566 | 452 | WriteProcessMemory |
Buffer => \xb8\x8b\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x08\x00\x90\x00\x00\x00\x00\x00\x00\x00\x00\x83\xec\x08R\x8bT$\x0c\x89T$\x08\xc7D$\x0c\x90\xb8\xa1\x00\xc7D$\x04\xe0G@\x00Z\xc3 ProcessHandle => 0x000001b0 BaseAddress => 0x00a1b890 |
SUCCESS | 0x00000001 | |
| 09:18:01,566 | 452 | VirtualProtectEx |
Protection => 0x00000008 ProcessHandle => 0x000001b0 Address => 0x7c90d6f0 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:18:01,566 | 452 | WriteProcessMemory |
Buffer => \xb8\x8b\x00\x00\x00\xba\xa8\xb8\xa1\x00\xff\xe2 ProcessHandle => 0x000001b0 BaseAddress => 0x7c90d6f0 |
SUCCESS | 0x00000001 | |
| 09:18:01,566 | 452 | VirtualProtectEx |
Protection => 0x00000020 ProcessHandle => 0x000001b0 Address => 0x7c90d6f0 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:18:01,566 | 452 | ReadProcessMemory |
Buffer => \xb8\x95\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x08\x00\x90 ProcessHandle => 0x000001b0 BaseAddress => 0x7c90d790 |
SUCCESS | 0x00000001 | |
| 09:18:01,566 | 452 | ReadProcessMemory |
Buffer => \xf0\xe4\x90| ProcessHandle => 0x000001b0 BaseAddress => 0x7ffe0300 |
SUCCESS | 0x00000001 | |
| 09:18:01,566 | 452 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:18:01,566 | 452 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:18:01,566 | 452 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:18:01,566 | 452 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:18:01,566 | 452 | WriteProcessMemory |
Buffer => \xb8\x95\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x08\x00\x90\x00\x00\x00\x00\x00\x00\x00\x00\x83\xec\x08R\x8bT$\x0c\x89T$\x08\xc7D$\x0c\xd0\xb8\xa1\x00\xc7D$\x04\x00\xedA\x00Z\xc3 ProcessHandle => 0x000001b0 BaseAddress => 0x00a1b8d0 |
SUCCESS | 0x00000001 | |
| 09:18:01,566 | 452 | VirtualProtectEx |
Protection => 0x00000008 ProcessHandle => 0x000001b0 Address => 0x7c90d790 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:18:01,566 | 452 | WriteProcessMemory |
Buffer => \xb8\x95\x00\x00\x00\xba\xe8\xb8\xa1\x00\xff\xe2 ProcessHandle => 0x000001b0 BaseAddress => 0x7c90d790 |
SUCCESS | 0x00000001 | |
| 09:18:01,566 | 452 | VirtualProtectEx |
Protection => 0x00000020 ProcessHandle => 0x000001b0 Address => 0x7c90d790 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:18:01,566 | 452 | ReadProcessMemory |
Buffer => \xb8\xe0\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x14\x00\x90 ProcessHandle => 0x000001b0 BaseAddress => 0x7c90dc40 |
SUCCESS | 0x00000001 | |
| 09:18:01,566 | 452 | ReadProcessMemory |
Buffer => \xf0\xe4\x90| ProcessHandle => 0x000001b0 BaseAddress => 0x7ffe0300 |
SUCCESS | 0x00000001 | |
| 09:18:01,576 | 452 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:18:01,576 | 452 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:18:01,576 | 452 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:18:01,576 | 452 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:18:01,576 | 452 | WriteProcessMemory |
Buffer => \xb8\xe0\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x14\x00\x90\x00\x00\x00\x00\x00\x00\x00\x00\x83\xec\x08R\x8bT$\x0c\x89T$\x08\xc7D$\x0c\x10\xb9\xa1\x00\xc7D$\x04 \xbdA\x00Z\xc3 ProcessHandle => 0x000001b0 BaseAddress => 0x00a1b910 |
SUCCESS | 0x00000001 | |
| 09:18:01,576 | 452 | VirtualProtectEx |
Protection => 0x00000008 ProcessHandle => 0x000001b0 Address => 0x7c90dc40 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:18:01,576 | 452 | WriteProcessMemory |
Buffer => \xb8\xe0\x00\x00\x00\xba(\xb9\xa1\x00\xff\xe2 ProcessHandle => 0x000001b0 BaseAddress => 0x7c90dc40 |
SUCCESS | 0x00000001 | |
| 09:18:01,576 | 452 | VirtualProtectEx |
Protection => 0x00000020 ProcessHandle => 0x000001b0 Address => 0x7c90dc40 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:18:01,576 | 452 | ReadProcessMemory |
Buffer => \xb8#\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x14\x00\x90 ProcessHandle => 0x000001b0 BaseAddress => 0x7c90d070 |
SUCCESS | 0x00000001 | |
| 09:18:01,576 | 452 | ReadProcessMemory |
Buffer => \xf0\xe4\x90| ProcessHandle => 0x000001b0 BaseAddress => 0x7ffe0300 |
SUCCESS | 0x00000001 | |
| 09:18:01,576 | 452 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:18:01,576 | 452 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:18:01,576 | 452 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:18:01,576 | 452 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:18:01,576 | 452 | WriteProcessMemory |
Buffer => \xb8#\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x14\x00\x90\x00\x00\x00\x00\x00\x00\x00\x00\x83\xec\x08R\x8bT$\x0c\x89T$\x08\xc7D$\x0cP\xb9\xa1\x00\xc7D$\x04pL@\x00Z\xc3 ProcessHandle => 0x000001b0 BaseAddress => 0x00a1b950 |
SUCCESS | 0x00000001 | |
| 09:18:01,576 | 452 | VirtualProtectEx |
Protection => 0x00000008 ProcessHandle => 0x000001b0 Address => 0x7c90d070 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:18:01,576 | 452 | WriteProcessMemory |
Buffer => \xb8#\x00\x00\x00\xbah\xb9\xa1\x00\xff\xe2 ProcessHandle => 0x000001b0 BaseAddress => 0x7c90d070 |
SUCCESS | 0x00000001 | |
| 09:18:01,576 | 452 | VirtualProtectEx |
Protection => 0x00000020 ProcessHandle => 0x000001b0 Address => 0x7c90d070 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:18:01,576 | 452 | ReadProcessMemory |
Buffer => \xb8r\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x0c\x00\x90 ProcessHandle => 0x000001b0 BaseAddress => 0x7c90d560 |
SUCCESS | 0x00000001 | |
| 09:18:01,576 | 452 | ReadProcessMemory |
Buffer => \xf0\xe4\x90| ProcessHandle => 0x000001b0 BaseAddress => 0x7ffe0300 |
SUCCESS | 0x00000001 | |
| 09:18:01,576 | 452 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:18:01,576 | 452 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:18:01,576 | 452 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:18:01,576 | 452 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:18:01,576 | 452 | WriteProcessMemory |
Buffer => \xb8r\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x0c\x00\x90\x00\x00\x00\x00\x00\x00\x00\x00\x83\xec\x08R\x8bT$\x0c\x89T$\x08\xc7D$\x0c\x90\xb9\xa1\x00\xc7D$\x04\xd0KA\x00Z\xc3 ProcessHandle => 0x000001b0 BaseAddress => 0x00a1b990 |
SUCCESS | 0x00000001 | |
| 09:18:01,586 | 452 | VirtualProtectEx |
Protection => 0x00000008 ProcessHandle => 0x000001b0 Address => 0x7c90d560 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:18:01,586 | 452 | WriteProcessMemory |
Buffer => \xb8r\x00\x00\x00\xba\xa8\xb9\xa1\x00\xff\xe2 ProcessHandle => 0x000001b0 BaseAddress => 0x7c90d560 |
SUCCESS | 0x00000001 | |
| 09:18:01,586 | 452 | VirtualProtectEx |
Protection => 0x00000020 ProcessHandle => 0x000001b0 Address => 0x7c90d560 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:18:01,586 | 452 | ReadProcessMemory |
Buffer => \xb8)\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x1c\x00\x90 ProcessHandle => 0x000001b0 BaseAddress => 0x7c90d0d0 |
SUCCESS | 0x00000001 | |
| 09:18:01,586 | 452 | ReadProcessMemory |
Buffer => \xf0\xe4\x90| ProcessHandle => 0x000001b0 BaseAddress => 0x7ffe0300 |
SUCCESS | 0x00000001 | |
| 09:18:01,586 | 452 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:18:01,586 | 452 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:18:01,586 | 452 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:18:01,586 | 452 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:18:01,586 | 452 | WriteProcessMemory |
Buffer => \xb8)\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x1c\x00\x90\x00\x00\x00\x00\x00\x00\x00\x00\x83\xec\x08R\x8bT$\x0c\x89T$\x08\xc7D$\x0c\xd0\xb9\xa1\x00\xc7D$\x04`\x9dA\x00Z\xc3 ProcessHandle => 0x000001b0 BaseAddress => 0x00a1b9d0 |
SUCCESS | 0x00000001 | |
| 09:18:01,586 | 452 | VirtualProtectEx |
Protection => 0x00000008 ProcessHandle => 0x000001b0 Address => 0x7c90d0d0 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:18:01,586 | 452 | WriteProcessMemory |
Buffer => \xb8)\x00\x00\x00\xba\xe8\xb9\xa1\x00\xff\xe2 ProcessHandle => 0x000001b0 BaseAddress => 0x7c90d0d0 |
SUCCESS | 0x00000001 | |
| 09:18:01,586 | 452 | VirtualProtectEx |
Protection => 0x00000020 ProcessHandle => 0x000001b0 Address => 0x7c90d0d0 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:18:01,586 | 452 | ReadProcessMemory |
Buffer => \xb8w\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x0c\x00\x90 ProcessHandle => 0x000001b0 BaseAddress => 0x7c90d5b0 |
SUCCESS | 0x00000001 | |
| 09:18:01,586 | 452 | ReadProcessMemory |
Buffer => \xf0\xe4\x90| ProcessHandle => 0x000001b0 BaseAddress => 0x7ffe0300 |
SUCCESS | 0x00000001 | |
| 09:18:01,586 | 452 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:18:01,586 | 452 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:18:01,586 | 452 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:18:01,586 | 452 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:18:01,586 | 452 | WriteProcessMemory |
Buffer => \xb8w\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x0c\x00\x90\x00\x00\x00\x00\x00\x00\x00\x00\x83\xec\x08R\x8bT$\x0c\x89T$\x08\xc7D$\x0c\x10\xba\xa1\x00\xc7D$\x04\x00\x10@\x00Z\xc3 ProcessHandle => 0x000001b0 BaseAddress => 0x00a1ba10 |
SUCCESS | 0x00000001 | |
| 09:18:01,586 | 452 | VirtualProtectEx |
Protection => 0x00000008 ProcessHandle => 0x000001b0 Address => 0x7c90d5b0 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:18:01,586 | 452 | WriteProcessMemory |
Buffer => \xb8w\x00\x00\x00\xba(\xba\xa1\x00\xff\xe2 ProcessHandle => 0x000001b0 BaseAddress => 0x7c90d5b0 |
SUCCESS | 0x00000001 | |
| 09:18:01,586 | 452 | VirtualProtectEx |
Protection => 0x00000020 ProcessHandle => 0x000001b0 Address => 0x7c90d5b0 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:18:01,586 | 452 | ReadProcessMemory |
Buffer => \xb8x\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x0c\x00\x90 ProcessHandle => 0x000001b0 BaseAddress => 0x7c90d5c0 |
SUCCESS | 0x00000001 | |
| 09:18:01,586 | 452 | ReadProcessMemory |
Buffer => \xf0\xe4\x90| ProcessHandle => 0x000001b0 BaseAddress => 0x7ffe0300 |
SUCCESS | 0x00000001 | |
| 09:18:01,586 | 452 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:18:01,596 | 452 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:18:01,596 | 452 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:18:01,596 | 452 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:18:01,596 | 452 | WriteProcessMemory |
Buffer => \xb8x\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x0c\x00\x90\x00\x00\x00\x00\x00\x00\x00\x00\x83\xec\x08R\x8bT$\x0c\x89T$\x08\xc7D$\x0cP\xba\xa1\x00\xc7D$\x04\x00NA\x00Z\xc3 ProcessHandle => 0x000001b0 BaseAddress => 0x00a1ba50 |
SUCCESS | 0x00000001 | |
| 09:18:01,596 | 452 | VirtualProtectEx |
Protection => 0x00000008 ProcessHandle => 0x000001b0 Address => 0x7c90d5c0 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:18:01,596 | 452 | WriteProcessMemory |
Buffer => \xb8x\x00\x00\x00\xbah\xba\xa1\x00\xff\xe2 ProcessHandle => 0x000001b0 BaseAddress => 0x7c90d5c0 |
SUCCESS | 0x00000001 | |
| 09:18:01,596 | 452 | VirtualProtectEx |
Protection => 0x00000020 ProcessHandle => 0x000001b0 Address => 0x7c90d5c0 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:18:01,596 | 452 | ReadProcessMemory |
Buffer => \xb8+\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x10\x00\x90 ProcessHandle => 0x000001b0 BaseAddress => 0x7c90d0f0 |
SUCCESS | 0x00000001 | |
| 09:18:01,596 | 452 | ReadProcessMemory |
Buffer => \xf0\xe4\x90| ProcessHandle => 0x000001b0 BaseAddress => 0x7ffe0300 |
SUCCESS | 0x00000001 | |
| 09:18:01,596 | 452 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:18:01,596 | 452 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:18:01,596 | 452 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:18:01,596 | 452 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:18:01,596 | 452 | WriteProcessMemory |
Buffer => \xb8+\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x10\x00\x90\x00\x00\x00\x00\x00\x00\x00\x00\x83\xec\x08R\x8bT$\x0c\x89T$\x08\xc7D$\x0c\x90\xba\xa1\x00\xc7D$\x04@K@\x00Z\xc3 ProcessHandle => 0x000001b0 BaseAddress => 0x00a1ba90 |
SUCCESS | 0x00000001 | |
| 09:18:01,596 | 452 | VirtualProtectEx |
Protection => 0x00000008 ProcessHandle => 0x000001b0 Address => 0x7c90d0f0 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:18:01,596 | 452 | WriteProcessMemory |
Buffer => \xb8+\x00\x00\x00\xba\xa8\xba\xa1\x00\xff\xe2 ProcessHandle => 0x000001b0 BaseAddress => 0x7c90d0f0 |
SUCCESS | 0x00000001 | |
| 09:18:01,596 | 452 | VirtualProtectEx |
Protection => 0x00000020 ProcessHandle => 0x000001b0 Address => 0x7c90d0f0 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:18:01,596 | 452 | ReadProcessMemory |
Buffer => \xb82\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x1c\x00\x90 ProcessHandle => 0x000001b0 BaseAddress => 0x7c90d160 |
SUCCESS | 0x00000001 | |
| 09:18:01,596 | 452 | ReadProcessMemory |
Buffer => \xf0\xe4\x90| ProcessHandle => 0x000001b0 BaseAddress => 0x7ffe0300 |
SUCCESS | 0x00000001 | |
| 09:18:01,596 | 452 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:18:01,596 | 452 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:18:01,596 | 452 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:18:01,596 | 452 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:18:01,596 | 452 | WriteProcessMemory |
Buffer => \xb82\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x1c\x00\x90\x00\x00\x00\x00\x00\x00\x00\x00\x83\xec\x08R\x8bT$\x0c\x89T$\x08\xc7D$\x0c\xd0\xba\xa1\x00\xc7D$\x04\xa0@@\x00Z\xc3 ProcessHandle => 0x000001b0 BaseAddress => 0x00a1bad0 |
SUCCESS | 0x00000001 | |
| 09:18:01,596 | 452 | VirtualProtectEx |
Protection => 0x00000008 ProcessHandle => 0x000001b0 Address => 0x7c90d160 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:18:01,606 | 452 | WriteProcessMemory |
Buffer => \xb82\x00\x00\x00\xba\xe8\xba\xa1\x00\xff\xe2 ProcessHandle => 0x000001b0 BaseAddress => 0x7c90d160 |
SUCCESS | 0x00000001 | |
| 09:18:01,606 | 452 | VirtualProtectEx |
Protection => 0x00000020 ProcessHandle => 0x000001b0 Address => 0x7c90d160 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:18:01,606 | 452 | ReadProcessMemory |
Buffer => \xb8}\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x0c\x00\x90 ProcessHandle => 0x000001b0 BaseAddress => 0x7c90d610 |
SUCCESS | 0x00000001 | |
| 09:18:01,606 | 452 | ReadProcessMemory |
Buffer => \xf0\xe4\x90| ProcessHandle => 0x000001b0 BaseAddress => 0x7ffe0300 |
SUCCESS | 0x00000001 | |
| 09:18:01,606 | 452 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:18:01,606 | 452 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:18:01,606 | 452 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:18:01,606 | 452 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:18:01,606 | 452 | WriteProcessMemory |
Buffer => \xb8}\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x0c\x00\x90\x00\x00\x00\x00\x00\x00\x00\x00\x83\xec\x08R\x8bT$\x0c\x89T$\x08\xc7D$\x0c\x10\xbb\xa1\x00\xc7D$\x04P\x13@\x00Z\xc3 ProcessHandle => 0x000001b0 BaseAddress => 0x00a1bb10 |
SUCCESS | 0x00000001 | |
| 09:18:01,606 | 452 | VirtualProtectEx |
Protection => 0x00000008 ProcessHandle => 0x000001b0 Address => 0x7c90d610 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:18:01,606 | 452 | WriteProcessMemory |
Buffer => \xb8}\x00\x00\x00\xba(\xbb\xa1\x00\xff\xe2 ProcessHandle => 0x000001b0 BaseAddress => 0x7c90d610 |
SUCCESS | 0x00000001 | |
| 09:18:01,606 | 452 | VirtualProtectEx |
Protection => 0x00000020 ProcessHandle => 0x000001b0 Address => 0x7c90d610 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:18:01,606 | 452 | ReadProcessMemory |
Buffer => \xb8A\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x08\x00\x90 ProcessHandle => 0x000001b0 BaseAddress => 0x7c90d250 |
SUCCESS | 0x00000001 | |
| 09:18:01,606 | 452 | ReadProcessMemory |
Buffer => \xf0\xe4\x90| ProcessHandle => 0x000001b0 BaseAddress => 0x7ffe0300 |
SUCCESS | 0x00000001 | |
| 09:18:01,606 | 452 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:18:01,606 | 452 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:18:01,606 | 452 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:18:01,606 | 452 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:18:01,606 | 452 | WriteProcessMemory |
Buffer => \xb8A\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x08\x00\x90\x00\x00\x00\x00\x00\x00\x00\x00\x83\xec\x08R\x8bT$\x0c\x89T$\x08\xc7D$\x0cP\xbb\xa1\x00\xc7D$\x04\x10\x8dF\x00Z\xc3 ProcessHandle => 0x000001b0 BaseAddress => 0x00a1bb50 |
SUCCESS | 0x00000001 | |
| 09:18:01,606 | 452 | VirtualProtectEx |
Protection => 0x00000008 ProcessHandle => 0x000001b0 Address => 0x7c90d250 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:18:01,606 | 452 | WriteProcessMemory |
Buffer => \xb8A\x00\x00\x00\xbah\xbb\xa1\x00\xff\xe2 ProcessHandle => 0x000001b0 BaseAddress => 0x7c90d250 |
SUCCESS | 0x00000001 | |
| 09:18:01,606 | 452 | VirtualProtectEx |
Protection => 0x00000020 ProcessHandle => 0x000001b0 Address => 0x7c90d250 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:18:01,606 | 452 | ReadProcessMemory |
Buffer => \xb8\x80\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x10\x00\x90 ProcessHandle => 0x000001b0 BaseAddress => 0x7c90d640 |
SUCCESS | 0x00000001 | |
| 09:18:01,616 | 452 | ReadProcessMemory |
Buffer => \xf0\xe4\x90| ProcessHandle => 0x000001b0 BaseAddress => 0x7ffe0300 |
SUCCESS | 0x00000001 | |
| 09:18:01,616 | 452 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:18:01,616 | 452 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:18:01,616 | 452 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:18:01,616 | 452 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:18:01,616 | 452 | WriteProcessMemory |
Buffer => \xb8\x80\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x10\x00\x90\x00\x00\x00\x00\x00\x00\x00\x00\x83\xec\x08R\x8bT$\x0c\x89T$\x08\xc7D$\x0c\x90\xbb\xa1\x00\xc7D$\x04`EF\x00Z\xc3 ProcessHandle => 0x000001b0 BaseAddress => 0x00a1bb90 |
SUCCESS | 0x00000001 | |
| 09:18:01,616 | 452 | VirtualProtectEx |
Protection => 0x00000008 ProcessHandle => 0x000001b0 Address => 0x7c90d640 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:18:01,616 | 452 | WriteProcessMemory |
Buffer => \xb8\x80\x00\x00\x00\xba\xa8\xbb\xa1\x00\xff\xe2 ProcessHandle => 0x000001b0 BaseAddress => 0x7c90d640 |
SUCCESS | 0x00000001 | |
| 09:18:01,616 | 452 | VirtualProtectEx |
Protection => 0x00000020 ProcessHandle => 0x000001b0 Address => 0x7c90d640 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:18:01,616 | 452 | ReadProcessMemory |
Buffer => \xb8z\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x10\x00\x90 ProcessHandle => 0x000001b0 BaseAddress => 0x7c90d5e0 |
SUCCESS | 0x00000001 | |
| 09:18:01,616 | 452 | ReadProcessMemory |
Buffer => \xf0\xe4\x90| ProcessHandle => 0x000001b0 BaseAddress => 0x7ffe0300 |
SUCCESS | 0x00000001 | |
| 09:18:01,616 | 452 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:18:01,616 | 452 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:18:01,616 | 452 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:18:01,616 | 452 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:18:01,616 | 452 | WriteProcessMemory |
Buffer => \xb8z\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x10\x00\x90\x00\x00\x00\x00\x00\x00\x00\x00\x83\xec\x08R\x8bT$\x0c\x89T$\x08\xc7D$\x0c\xd0\xbb\xa1\x00\xc7D$\x040\xb1A\x00Z\xc3 ProcessHandle => 0x000001b0 BaseAddress => 0x00a1bbd0 |
SUCCESS | 0x00000001 | |
| 09:18:01,616 | 452 | VirtualProtectEx |
Protection => 0x00000008 ProcessHandle => 0x000001b0 Address => 0x7c90d5e0 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:18:01,616 | 452 | WriteProcessMemory |
Buffer => \xb8z\x00\x00\x00\xba\xe8\xbb\xa1\x00\xff\xe2 ProcessHandle => 0x000001b0 BaseAddress => 0x7c90d5e0 |
SUCCESS | 0x00000001 | |
| 09:18:01,616 | 452 | VirtualProtectEx |
Protection => 0x00000020 ProcessHandle => 0x000001b0 Address => 0x7c90d5e0 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:18:01,616 | 452 | ReadProcessMemory |
Buffer => \xb8{\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x0c\x00\x90 ProcessHandle => 0x000001b0 BaseAddress => 0x7c90d5f0 |
SUCCESS | 0x00000001 | |
| 09:18:01,616 | 452 | ReadProcessMemory |
Buffer => \xf0\xe4\x90| ProcessHandle => 0x000001b0 BaseAddress => 0x7ffe0300 |
SUCCESS | 0x00000001 | |
| 09:18:01,616 | 452 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:18:01,616 | 452 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:18:01,626 | 452 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:18:01,626 | 452 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:18:01,626 | 452 | WriteProcessMemory |
Buffer => \xb8{\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x0c\x00\x90\x00\x00\x00\x00\x00\x00\x00\x00\x83\xec\x08R\x8bT$\x0c\x89T$\x08\xc7D$\x0c\x10\xbc\xa1\x00\xc7D$\x040B@\x00Z\xc3 ProcessHandle => 0x000001b0 BaseAddress => 0x00a1bc10 |
SUCCESS | 0x00000001 | |
| 09:18:01,626 | 452 | VirtualProtectEx |
Protection => 0x00000008 ProcessHandle => 0x000001b0 Address => 0x7c90d5f0 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:18:01,626 | 452 | WriteProcessMemory |
Buffer => \xb8{\x00\x00\x00\xba(\xbc\xa1\x00\xff\xe2 ProcessHandle => 0x000001b0 BaseAddress => 0x7c90d5f0 |
SUCCESS | 0x00000001 | |
| 09:18:01,626 | 452 | VirtualProtectEx |
Protection => 0x00000020 ProcessHandle => 0x000001b0 Address => 0x7c90d5f0 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:18:01,626 | 452 | ReadProcessMemory |
Buffer => \xb8\xe5\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x10\x00\x90 ProcessHandle => 0x000001b0 BaseAddress => 0x7c90dc90 |
SUCCESS | 0x00000001 | |
| 09:18:01,626 | 452 | ReadProcessMemory |
Buffer => \xf0\xe4\x90| ProcessHandle => 0x000001b0 BaseAddress => 0x7ffe0300 |
SUCCESS | 0x00000001 | |
| 09:18:01,626 | 452 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:18:01,626 | 452 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:18:01,626 | 452 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:18:01,626 | 452 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:18:01,626 | 452 | WriteProcessMemory |
Buffer => \xb8\xe5\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x10\x00\x90\x00\x00\x00\x00\x00\x00\x00\x00\x83\xec\x08R\x8bT$\x0c\x89T$\x08\xc7D$\x0cP\xbc\xa1\x00\xc7D$\x04PJA\x00Z\xc3 ProcessHandle => 0x000001b0 BaseAddress => 0x00a1bc50 |
SUCCESS | 0x00000001 | |
| 09:18:01,626 | 452 | VirtualProtectEx |
Protection => 0x00000008 ProcessHandle => 0x000001b0 Address => 0x7c90dc90 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:18:01,626 | 452 | WriteProcessMemory |
Buffer => \xb8\xe5\x00\x00\x00\xbah\xbc\xa1\x00\xff\xe2 ProcessHandle => 0x000001b0 BaseAddress => 0x7c90dc90 |
SUCCESS | 0x00000001 | |
| 09:18:01,626 | 452 | VirtualProtectEx |
Protection => 0x00000020 ProcessHandle => 0x000001b0 Address => 0x7c90dc90 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:18:01,626 | 452 | ReadProcessMemory |
Buffer => \xb8\x81\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x10\x00\x90 ProcessHandle => 0x000001b0 BaseAddress => 0x7c90d650 |
SUCCESS | 0x00000001 | |
| 09:18:01,626 | 452 | ReadProcessMemory |
Buffer => \xf0\xe4\x90| ProcessHandle => 0x000001b0 BaseAddress => 0x7ffe0300 |
SUCCESS | 0x00000001 | |
| 09:18:01,626 | 452 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:18:01,626 | 452 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:18:01,626 | 452 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:18:01,626 | 452 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:18:01,636 | 452 | WriteProcessMemory |
Buffer => \xb8\x81\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x10\x00\x90\x00\x00\x00\x00\x00\x00\x00\x00\x83\xec\x08R\x8bT$\x0c\x89T$\x08\xc7D$\x0c\x90\xbc\xa1\x00\xc7D$\x04\xd05A\x00Z\xc3 ProcessHandle => 0x000001b0 BaseAddress => 0x00a1bc90 |
SUCCESS | 0x00000001 | |
| 09:18:01,636 | 452 | VirtualProtectEx |
Protection => 0x00000008 ProcessHandle => 0x000001b0 Address => 0x7c90d650 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:18:01,636 | 452 | WriteProcessMemory |
Buffer => \xb8\x81\x00\x00\x00\xba\xa8\xbc\xa1\x00\xff\xe2 ProcessHandle => 0x000001b0 BaseAddress => 0x7c90d650 |
SUCCESS | 0x00000001 | |
| 09:18:01,636 | 452 | VirtualProtectEx |
Protection => 0x00000020 ProcessHandle => 0x000001b0 Address => 0x7c90d650 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:18:01,636 | 452 | ReadProcessMemory |
Buffer => \xb8|\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x10\x00\x90 ProcessHandle => 0x000001b0 BaseAddress => 0x7c90d600 |
SUCCESS | 0x00000001 | |
| 09:18:01,636 | 452 | ReadProcessMemory |
Buffer => \xf0\xe4\x90| ProcessHandle => 0x000001b0 BaseAddress => 0x7ffe0300 |
SUCCESS | 0x00000001 | |
| 09:18:01,636 | 452 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:18:01,636 | 452 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:18:01,636 | 452 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:18:01,636 | 452 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:18:01,636 | 452 | WriteProcessMemory |
Buffer => \xb8|\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x10\x00\x90\x00\x00\x00\x00\x00\x00\x00\x00\x83\xec\x08R\x8bT$\x0c\x89T$\x08\xc7D$\x0c\xd0\xbc\xa1\x00\xc7D$\x04\x00\x99A\x00Z\xc3 ProcessHandle => 0x000001b0 BaseAddress => 0x00a1bcd0 |
SUCCESS | 0x00000001 | |
| 09:18:01,636 | 452 | VirtualProtectEx |
Protection => 0x00000008 ProcessHandle => 0x000001b0 Address => 0x7c90d600 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:18:01,636 | 452 | WriteProcessMemory |
Buffer => \xb8|\x00\x00\x00\xba\xe8\xbc\xa1\x00\xff\xe2 ProcessHandle => 0x000001b0 BaseAddress => 0x7c90d600 |
SUCCESS | 0x00000001 | |
| 09:18:01,636 | 452 | VirtualProtectEx |
Protection => 0x00000020 ProcessHandle => 0x000001b0 Address => 0x7c90d600 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:18:01,636 | 452 | ReadProcessMemory |
Buffer => \xb8\x82\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x14\x00\x90 ProcessHandle => 0x000001b0 BaseAddress => 0x7c90d660 |
SUCCESS | 0x00000001 | |
| 09:18:01,636 | 452 | ReadProcessMemory |
Buffer => \xf0\xe4\x90| ProcessHandle => 0x000001b0 BaseAddress => 0x7ffe0300 |
SUCCESS | 0x00000001 | |
| 09:18:01,636 | 452 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:18:01,636 | 452 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:18:01,636 | 452 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:18:01,636 | 452 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:18:01,636 | 452 | WriteProcessMemory |
Buffer => \xb8\x82\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x14\x00\x90\x00\x00\x00\x00\x00\x00\x00\x00\x83\xec\x08R\x8bT$\x0c\x89T$\x08\xc7D$\x0c\x10\xbd\xa1\x00\xc7D$\x04\xf0C@\x00Z\xc3 ProcessHandle => 0x000001b0 BaseAddress => 0x00a1bd10 |
SUCCESS | 0x00000001 | |
| 09:18:01,636 | 452 | VirtualProtectEx |
Protection => 0x00000008 ProcessHandle => 0x000001b0 Address => 0x7c90d660 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:18:01,636 | 452 | WriteProcessMemory |
Buffer => \xb8\x82\x00\x00\x00\xba(\xbd\xa1\x00\xff\xe2 ProcessHandle => 0x000001b0 BaseAddress => 0x7c90d660 |
SUCCESS | 0x00000001 | |
| 09:18:01,636 | 452 | VirtualProtectEx |
Protection => 0x00000020 ProcessHandle => 0x000001b0 Address => 0x7c90d660 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:18:01,646 | 452 | ReadProcessMemory |
Buffer => \xb8\x08\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x0c\x00\x90 ProcessHandle => 0x000001b0 BaseAddress => 0x7c90cec0 |
SUCCESS | 0x00000001 | |
| 09:18:01,646 | 452 | ReadProcessMemory |
Buffer => \xf0\xe4\x90| ProcessHandle => 0x000001b0 BaseAddress => 0x7ffe0300 |
SUCCESS | 0x00000001 | |
| 09:18:01,646 | 452 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:18:01,646 | 452 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:18:01,646 | 452 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:18:01,646 | 452 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:18:01,646 | 452 | WriteProcessMemory |
Buffer => \xb8\x08\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x0c\x00\x90\x00\x00\x00\x00\x00\x00\x00\x00\x83\xec\x08R\x8bT$\x0c\x89T$\x08\xc7D$\x0cP\xbd\xa1\x00\xc7D$\x04\x80#A\x00Z\xc3 ProcessHandle => 0x000001b0 BaseAddress => 0x00a1bd50 |
SUCCESS | 0x00000001 | |
| 09:18:01,646 | 452 | VirtualProtectEx |
Protection => 0x00000008 ProcessHandle => 0x000001b0 Address => 0x7c90cec0 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:18:01,646 | 452 | WriteProcessMemory |
Buffer => \xb8\x08\x00\x00\x00\xbah\xbd\xa1\x00\xff\xe2 ProcessHandle => 0x000001b0 BaseAddress => 0x7c90cec0 |
SUCCESS | 0x00000001 | |
| 09:18:01,646 | 452 | VirtualProtectEx |
Protection => 0x00000020 ProcessHandle => 0x000001b0 Address => 0x7c90cec0 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:18:01,646 | 452 | ReadProcessMemory |
Buffer => \xb8L\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x0c\x00\x90 ProcessHandle => 0x000001b0 BaseAddress => 0x7c90d300 |
SUCCESS | 0x00000001 | |
| 09:18:01,646 | 452 | ReadProcessMemory |
Buffer => \xf0\xe4\x90| ProcessHandle => 0x000001b0 BaseAddress => 0x7ffe0300 |
SUCCESS | 0x00000001 | |
| 09:18:01,646 | 452 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:18:01,646 | 452 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:18:01,646 | 452 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:18:01,646 | 452 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:18:01,646 | 452 | WriteProcessMemory |
Buffer => \xb8L\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x0c\x00\x90\x00\x00\x00\x00\x00\x00\x00\x00\x83\xec\x08R\x8bT$\x0c\x89T$\x08\xc7D$\x0c\x90\xbd\xa1\x00\xc7D$\x04\xa0\xf4A\x00Z\xc3 ProcessHandle => 0x000001b0 BaseAddress => 0x00a1bd90 |
SUCCESS | 0x00000001 | |
| 09:18:01,646 | 452 | VirtualProtectEx |
Protection => 0x00000008 ProcessHandle => 0x000001b0 Address => 0x7c90d300 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:18:01,646 | 452 | WriteProcessMemory |
Buffer => \xb8L\x00\x00\x00\xba\xa8\xbd\xa1\x00\xff\xe2 ProcessHandle => 0x000001b0 BaseAddress => 0x7c90d300 |
SUCCESS | 0x00000001 | |
| 09:18:01,646 | 452 | VirtualProtectEx |
Protection => 0x00000020 ProcessHandle => 0x000001b0 Address => 0x7c90d300 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:18:01,646 | 452 | ReadProcessMemory |
Buffer => \xb8<\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x04\x00\x90 ProcessHandle => 0x000001b0 BaseAddress => 0x7c90d200 |
SUCCESS | 0x00000001 | |
| 09:18:01,646 | 452 | ReadProcessMemory |
Buffer => \xf0\xe4\x90| ProcessHandle => 0x000001b0 BaseAddress => 0x7ffe0300 |
SUCCESS | 0x00000001 | |
| 09:18:01,646 | 452 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:18:01,656 | 452 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:18:01,656 | 452 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:18:01,656 | 452 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:18:01,656 | 452 | WriteProcessMemory |
Buffer => \xb8<\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x04\x00\x90\x00\x00\x00\x00\x00\x00\x00\x00\x83\xec\x08R\x8bT$\x0c\x89T$\x08\xc7D$\x0c\xd0\xbd\xa1\x00\xc7D$\x04\x80\x7fN\x00Z\xc3 ProcessHandle => 0x000001b0 BaseAddress => 0x00a1bdd0 |
SUCCESS | 0x00000001 | |
| 09:18:01,656 | 452 | VirtualProtectEx |
Protection => 0x00000008 ProcessHandle => 0x000001b0 Address => 0x7c90d200 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:18:01,656 | 452 | WriteProcessMemory |
Buffer => \xb8<\x00\x00\x00\xba\xe8\xbd\xa1\x00\xff\xe2 ProcessHandle => 0x000001b0 BaseAddress => 0x7c90d200 |
SUCCESS | 0x00000001 | |
| 09:18:01,656 | 452 | VirtualProtectEx |
Protection => 0x00000020 ProcessHandle => 0x000001b0 Address => 0x7c90d200 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:18:01,656 | 452 | ReadProcessMemory |
Buffer => \xb8\x96\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x14\x00\x90 ProcessHandle => 0x000001b0 BaseAddress => 0x7c90d7a0 |
SUCCESS | 0x00000001 | |
| 09:18:01,656 | 452 | ReadProcessMemory |
Buffer => \xf0\xe4\x90| ProcessHandle => 0x000001b0 BaseAddress => 0x7ffe0300 |
SUCCESS | 0x00000001 | |
| 09:18:01,656 | 452 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:18:01,656 | 452 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:18:01,656 | 452 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:18:01,656 | 452 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:18:01,656 | 452 | WriteProcessMemory |
Buffer => \xb8\x96\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x14\x00\x90\x00\x00\x00\x00\x00\x00\x00\x00\x83\xec\x08R\x8bT$\x0c\x89T$\x08\xc7D$\x0c\x10\xbe\xa1\x00\xc7D$\x04p\x80N\x00Z\xc3 ProcessHandle => 0x000001b0 BaseAddress => 0x00a1be10 |
SUCCESS | 0x00000001 | |
| 09:18:01,656 | 452 | VirtualProtectEx |
Protection => 0x00000008 ProcessHandle => 0x000001b0 Address => 0x7c90d7a0 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:18:01,656 | 452 | WriteProcessMemory |
Buffer => \xb8\x96\x00\x00\x00\xba(\xbe\xa1\x00\xff\xe2 ProcessHandle => 0x000001b0 BaseAddress => 0x7c90d7a0 |
SUCCESS | 0x00000001 | |
| 09:18:01,656 | 452 | VirtualProtectEx |
Protection => 0x00000020 ProcessHandle => 0x000001b0 Address => 0x7c90d7a0 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:18:01,656 | 452 | ReadProcessMemory |
Buffer => \xb8l\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2(\x00\x90 ProcessHandle => 0x000001b0 BaseAddress => 0x7c90d500 |
SUCCESS | 0x00000001 | |
| 09:18:01,656 | 452 | ReadProcessMemory |
Buffer => \xf0\xe4\x90| ProcessHandle => 0x000001b0 BaseAddress => 0x7ffe0300 |
SUCCESS | 0x00000001 | |
| 09:18:01,656 | 452 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:18:01,656 | 452 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:18:01,656 | 452 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:18:01,656 | 452 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:18:01,656 | 452 | WriteProcessMemory |
Buffer => \xb8l\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2(\x00\x90\x00\x00\x00\x00\x00\x00\x00\x00\x83\xec\x08R\x8bT$\x0c\x89T$\x08\xc7D$\x0cP\xbe\xa1\x00\xc7D$\x04\x80\x14@\x00Z\xc3 ProcessHandle => 0x000001b0 BaseAddress => 0x00a1be50 |
SUCCESS | 0x00000001 | |
| 09:18:01,666 | 452 | VirtualProtectEx |
Protection => 0x00000008 ProcessHandle => 0x000001b0 Address => 0x7c90d500 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:18:01,666 | 452 | WriteProcessMemory |
Buffer => \xb8l\x00\x00\x00\xbah\xbe\xa1\x00\xff\xe2 ProcessHandle => 0x000001b0 BaseAddress => 0x7c90d500 |
SUCCESS | 0x00000001 | |
| 09:18:01,666 | 452 | VirtualProtectEx |
Protection => 0x00000020 ProcessHandle => 0x000001b0 Address => 0x7c90d500 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:18:01,666 | 452 | ReadProcessMemory |
Buffer => \xb8\x0b\x01\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x08\x00\x90 ProcessHandle => 0x000001b0 BaseAddress => 0x7c90def0 |
SUCCESS | 0x00000001 | |
| 09:18:01,666 | 452 | ReadProcessMemory |
Buffer => \xf0\xe4\x90| ProcessHandle => 0x000001b0 BaseAddress => 0x7ffe0300 |
SUCCESS | 0x00000001 | |
| 09:18:01,666 | 452 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:18:01,666 | 452 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:18:01,666 | 452 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:18:01,666 | 452 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:18:01,666 | 452 | WriteProcessMemory |
Buffer => \xb8\x0b\x01\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x08\x00\x90\x00\x00\x00\x00\x00\x00\x00\x00\x83\xec\x08R\x8bT$\x0c\x89T$\x08\xc7D$\x0c\x90\xbe\xa1\x00\xc7D$\x04pI@\x00Z\xc3 ProcessHandle => 0x000001b0 BaseAddress => 0x00a1be90 |
SUCCESS | 0x00000001 | |
| 09:18:01,666 | 452 | VirtualProtectEx |
Protection => 0x00000008 ProcessHandle => 0x000001b0 Address => 0x7c90def0 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:18:01,666 | 452 | WriteProcessMemory |
Buffer => \xb8\x0b\x01\x00\x00\xba\xa8\xbe\xa1\x00\xff\xe2 ProcessHandle => 0x000001b0 BaseAddress => 0x7c90def0 |
SUCCESS | 0x00000001 | |
| 09:18:01,666 | 452 | VirtualProtectEx |
Protection => 0x00000020 ProcessHandle => 0x000001b0 Address => 0x7c90def0 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:18:01,666 | 452 | WriteProcessMemory |
Buffer => \x10\x07\x00\x00\xd0\x06\x00\x00\x8c\xf7\x12\x00\x1b\x00\x00\x00 ProcessHandle => 0x000001b0 BaseAddress => 0x00a1b800 |
SUCCESS | 0x00000001 | |
| 09:18:01,666 | 452 | VirtualProtectEx |
Protection => 0x00000020 ProcessHandle => 0x000001b0 Address => 0x00a1b800 Size => 0x00000710 |
SUCCESS | 0x00000001 | |
| 09:18:01,666 | 452 | WriteProcessMemory |
Buffer => P\xbe\xa1\x00\x90\xbe\xa1\x00P\xbc\xa1\x00\x90\xbc\xa1\x00\x10\xbd\xa1\x00\x90\xbb\xa1\x00\xd0\xbb\xa1\x00\x10\xbc\xa1\x00\xd0\xbc\xa1\x00\x10\xb8\xa1\x00P\xb8\xa1\x00\x90\xb8\xa1\x00\xd0\xb8\xa1\x00\x10\xb9\xa1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xd0\xb9\xa1\x00\x10\xba\xa1\x00\x00\x00\x00\x00P\xb9\xa1\x00\x90\xb9\xa1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00P\xba\xa1\x00\x90\xba\xa1\x00\xd0\xba\xa1\x00\x10\xbb\xa1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 ProcessHandle => 0x000001b0 BaseAddress => 0x0053f598 |
SUCCESS | 0x00000001 | |
| 09:18:01,676 | 452 | WriteProcessMemory |
Buffer => \x00\x00\xa0\x00 ProcessHandle => 0x000001b0 BaseAddress => 0x0053fa74 |
SUCCESS | 0x00000001 | |
| 09:18:01,676 | 452 | LdrGetDllHandle |
ModuleHandle => 0x7c900000 FileName => ntdll.dll |
SUCCESS | 0x00000000 | |
| 09:18:01,676 | 452 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:18:01,676 | 452 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:18:01,676 | 452 | WriteProcessMemory |
Buffer => P\xcf\x90|\xd0\xcf\x90|\x80\xd2\x90|p\xd3\x90|\x00\xd5\x90|\xd0\xd6\x90|\xe0\xd7\x90|p\xd8\x90|\xb0\xd8\x90|`\xd9\x90|\xf0\xde\x90|\xa4\x00\x91|\x1b\xeb\x90|\x88y\x91|b\\x92|j\xdf\x92|\xced\x92|
\xff\x90|}\x98\x91|E&\x90|*\xfe\x90|\xf0\xd7\x90|\x90\xd0\x90|@\xdc\x90|\xf0\xd6\x90|\x90\xd7\x90|\xb0\xd5\x90|\xd0\xd0\x90|P\xd2\x90|\xf0\xd0\x90|\xc0\xd5\x90|`\xd1\x90|\x10\xd6\x90|\xc0\xce\x90|\x00\xd3\x90|\x00\xd2\x90|\xa0\xd7\x90|@\xd6\x90|\xe0\xd5\x90|\xf0\xd5\x90|\x00\xd6\x90| ProcessHandle => 0x000001b0 BaseAddress => 0x0053f4b8 |
SUCCESS | 0x00000001 | |
| 09:18:01,676 | 452 | NtCreateSection |
ObjectAttributes => DesiredAccess => 0x000f0007 SectionHandle => 0x000001a4 FileHandle => 0x00000000 |
SUCCESS | 0x00000000 | |
| 09:18:01,676 | 452 | ZwMapViewOfSection |
SectionOffset => 0x0012f7b4 SectionHandle => 0x000001a4 ProcessHandle => 0xffffffff BaseAddress => 0x019c0000 |
SUCCESS | 0x00000000 | |
| 09:18:01,676 | 452 | WriteProcessMemory |
Buffer => \x0c\x00\x00\x00 ProcessHandle => 0x000001b0 BaseAddress => 0x0053f4ac |
SUCCESS | 0x00000001 | |
| 09:18:01,676 | 452 | WriteProcessMemory |
Buffer => \x00\x00 \x00 ProcessHandle => 0x000001b0 BaseAddress => 0x0053f560 |
SUCCESS | 0x00000001 | |
| 09:18:01,676 | 452 | WriteProcessMemory |
Buffer => \x00\x00\x00\x00 ProcessHandle => 0x000001b0 BaseAddress => 0x0053f564 |
SUCCESS | 0x00000001 | |
| 09:18:01,676 | 452 | NtCreateMutant |
Handle => 0x00000198 InitialOwner => 1 MutexName => |
SUCCESS | 0x00000000 | |
| 09:18:01,676 | 452 | CreateRemoteThread |
Parameter => 0x00000000 ProcessHandle => 0xffffffff ThreadId => 0 StartRoutine => 0x7c927ebb CreationFlags => 4 |
SUCCESS | 0x000001c8 | |
| 09:18:01,676 | 452 | NtResumeThread |
SuspendCount => 1 ThreadHandle => 0x000001c8 |
SUCCESS | 0x00000000 | |
| 09:18:01,686 | 1468 | NtDelayExecution |
Milliseconds => 1566804069 |
SUCCESS | 0x00000000 | |
| 09:18:01,686 | 452 | CreateRemoteThread |
Parameter => 0x00000000 ProcessHandle => 0xffffffff ThreadId => 0 StartRoutine => 0x7c910230 CreationFlags => 4 |
SUCCESS | 0x000001d0 | |
| 09:18:01,686 | 452 | NtResumeThread |
SuspendCount => 1 ThreadHandle => 0x000001d0 |
SUCCESS | 0x00000000 | |
| 09:18:01,686 | 452 | CreateRemoteThread |
Parameter => 0x00000000 ProcessHandle => 0xffffffff ThreadId => 0 StartRoutine => 0x7c929b6f CreationFlags => 4 |
SUCCESS | 0x000001dc | |
| 09:18:01,686 | 452 | NtResumeThread |
SuspendCount => 1 ThreadHandle => 0x000001dc |
SUCCESS | 0x00000000 | |
| 09:18:01,686 | 452 | WriteProcessMemory |
Buffer => \x04\x00\x00\x00 ProcessHandle => 0x000001b0 BaseAddress => 0x0053aae8 |
SUCCESS | 0x00000001 | |
| 09:18:01,686 | 452 | NtOpenFile |
ShareAccess => 3 FileName => C:\WINDOWS\system32 DesiredAccess => 0x00100020 FileHandle => 0x00000250 |
SUCCESS | 0x00000000 | |
| 09:18:01,696 | 452 | NtResumeThread |
SuspendCount => 1 ThreadHandle => 0x0000019c |
SUCCESS | 0x00000000 | |
| 09:18:02,427 | 1656 | CreateRemoteThread |
Parameter => 0x00000000 ProcessHandle => 0xffffffff ThreadId => 0 StartRoutine => 0x7c910230 CreationFlags => 4 |
SUCCESS | 0x0000019c | |
| 09:18:02,427 | 1656 | NtResumeThread |
SuspendCount => 1 ThreadHandle => 0x0000019c |
SUCCESS | 0x00000000 | |
| 09:18:02,427 | 1640 | RegOpenKeyExW |
Handle => 0x0000019c Registry => 0x80000002 SubKey => System |
SUCCESS | 0x00000000 | |
| 09:18:02,437 | 1640 | RegCloseKey |
Handle => 0x0000019c |
SUCCESS | 0x00000000 | |
| 09:18:02,437 | 1640 | RegCreateKeyExW |
Handle => 0x0000019c Access => 33554432 Registry => 0x80000002 Class => SubKey => System\Acrobatbrokerserverdispatchercpp789 |
SUCCESS | 0x00000000 | |
| 09:18:02,437 | 1640 | RegCloseKey |
Handle => 0x0000019c |
SUCCESS | 0x00000000 | |
| 09:18:02,437 | 1640 | RegDeleteKeyW |
Handle => 0x80000002 SubKey => System\Acrobatbrokerserverdispatchercpp789 |
SUCCESS | 0x00000000 | |
| 09:18:02,467 | 1640 | LdrGetDllHandle |
ModuleHandle => 0x7c900000 FileName => ntdll.dll |
SUCCESS | 0x00000000 | |
| 09:18:02,467 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => RtlInitUnicodeString FunctionAddress => 0x7c901295 ModuleHandle => 0x7c900000 |
SUCCESS | 0x00000000 | |
| 09:18:02,467 | 1640 | NtOpenKey |
DesiredAccess => 33554432 KeyHandle => 0x00000000 ObjectAttributes => Software\Adobe\Acrobat Reader\11.0\Installer\Migrated |
FAILURE | 3221225524 | |
| 09:18:02,467 | 1640 | NtCreateKey |
ObjectAttributes => Software\Adobe\Acrobat Reader\11.0\Installer\Migrated DesiredAccess => 3758293023 KeyHandle => 0x00000264 Class => |
SUCCESS | 0x00000000 | |
| 09:18:02,467 | 1640 | NtOpenKey |
DesiredAccess => 196639 KeyHandle => 0x00000264 ObjectAttributes => Software\Adobe\Acrobat Reader\11.0\Installer\Migrated |
SUCCESS | 0x00000000 | |
| 09:18:02,467 | 1640 | NtCreateKey |
ObjectAttributes => Software\Adobe\Acrobat Reader\11.0\Installer\Migrated DesiredAccess => 196639 KeyHandle => 0x00000264 Class => |
SUCCESS | 0x00000000 | |
| 09:18:02,477 | 1640 | NtOpenKey |
DesiredAccess => 33554432 KeyHandle => 0x00000000 ObjectAttributes => Language |
FAILURE | 3221225524 | |
| 09:18:02,477 | 1640 | NtCreateKey |
ObjectAttributes => Language DesiredAccess => 3758293023 KeyHandle => 0x00000268 Class => |
SUCCESS | 0x00000000 | |
| 09:18:02,477 | 1640 | NtCreateKey |
ObjectAttributes => UseMUI DesiredAccess => 196639 KeyHandle => 0x00000268 Class => |
SUCCESS | 0x00000000 | |
| 09:18:02,487 | 1640 | NtCreateKey |
ObjectAttributes => Software\Adobe\Acrobat Reader\11.0\Language\current DesiredAccess => 196639 KeyHandle => 0x00000268 Class => |
SUCCESS | 0x00000000 | |
| 09:18:02,527 | 1640 | NtCreateKey |
ObjectAttributes => Software\Adobe\Acrobat Reader\11.0\Originals DesiredAccess => 2 KeyHandle => 0x00000268 Class => |
SUCCESS | 0x00000000 | |
| 09:18:03,068 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002021a8 | 1 time |
| 09:18:03,078 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000264 |
SUCCESS | 0x00000000 | |
| 09:18:03,078 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000268 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:03,078 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002021a8 | |
| 09:18:03,078 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe |
SUCCESS | 0x002021a8 | |
| 09:18:03,078 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000264 |
SUCCESS | 0x00000000 | |
| 09:18:03,078 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000268 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:03,088 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002021a8 | |
| 09:18:03,088 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe |
SUCCESS | 0x002021a8 | |
| 09:18:03,088 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat |
SUCCESS | 0x002021a8 | |
| 09:18:03,088 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000264 |
SUCCESS | 0x00000000 | |
| 09:18:03,088 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000268 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:03,088 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002021a8 | |
| 09:18:03,088 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe |
SUCCESS | 0x002021a8 | |
| 09:18:03,098 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat |
SUCCESS | 0x002021a8 | |
| 09:18:03,098 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000264 |
SUCCESS | 0x00000000 | |
| 09:18:03,098 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000268 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:03,098 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002021a8 | |
| 09:18:03,098 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe |
SUCCESS | 0x002021a8 | |
| 09:18:03,098 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat |
SUCCESS | 0x002021a8 | |
| 09:18:03,098 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000264 |
SUCCESS | 0x00000000 | |
| 09:18:03,098 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000268 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:03,268 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002021a8 | |
| 09:18:03,268 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000264 |
SUCCESS | 0x00000000 | |
| 09:18:03,268 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000268 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:03,268 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002021a8 | |
| 09:18:03,268 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000264 |
SUCCESS | 0x00000000 | |
| 09:18:03,278 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000268 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:03,278 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002021a8 | |
| 09:18:03,278 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000264 |
SUCCESS | 0x00000000 | |
| 09:18:03,278 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000268 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:04,210 | 1640 | NtCreateKey |
ObjectAttributes => Software\Adobe\Acrobat Reader\11.0\ExitSection DesiredAccess => 2 KeyHandle => 0x00000268 Class => |
SUCCESS | 0x00000000 | |
| 09:18:04,410 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002021a8 | |
| 09:18:04,410 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe |
SUCCESS | 0x002021a8 | |
| 09:18:04,420 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002021a8 | |
| 09:18:04,420 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe |
SUCCESS | 0x002021a8 | |
| 09:18:04,420 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Color |
SUCCESS | 0x002021a8 | |
| 09:18:04,420 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002021a8 | |
| 09:18:04,430 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe |
SUCCESS | 0x002021a8 | |
| 09:18:04,430 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Color |
SUCCESS | 0x002021a8 | |
| 09:18:04,430 | 1640 | NtCreateFile |
ShareAccess => 0 FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Color\ACECache11.lst DesiredAccess => 0x00120196 CreateDisposition => 5 FileHandle => 0x00000264 |
SUCCESS | 0x00000000 | |
| 09:18:04,430 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000268 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:04,430 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000264 FileInformation => \xa0\x85\x15\xb5\x8a\xa2\xcf\x01\xa0\x85\x15\xb5\x8a\xa2\xcf\x01\xa0\x85\x15\xb5\x8a\xa2\xcf\x01\xa0\x85\x15\xb5\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00:L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x96\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:04,500 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002021a8 | 1 time |
| 09:18:04,510 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002021a8 | |
| 09:18:04,510 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002021a8 | |
| 09:18:04,510 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002021a8 | |
| 09:18:04,510 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000264 |
SUCCESS | 0x00000000 | |
| 09:18:04,520 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000268 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:04,520 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002021a8 | |
| 09:18:04,520 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002021a8 | |
| 09:18:04,520 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002021a8 | |
| 09:18:04,520 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002021a8 | |
| 09:18:04,520 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000264 |
SUCCESS | 0x00000000 | |
| 09:18:04,520 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000268 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:04,520 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002021a8 | |
| 09:18:04,520 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002021a8 | |
| 09:18:04,520 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002021a8 | |
| 09:18:04,530 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002021a8 | |
| 09:18:04,530 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000264 |
SUCCESS | 0x00000000 | |
| 09:18:04,530 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000268 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:04,610 | 1640 | NtCreateKey |
ObjectAttributes => Software\Adobe\Acrobat Reader\11.0\ServicesRdr DesiredAccess => 196639 KeyHandle => 0x00000268 Class => |
SUCCESS | 0x00000000 | |
| 09:18:04,610 | 1640 | NtCreateKey |
ObjectAttributes => cInstallTypes DesiredAccess => 196639 KeyHandle => 0x00000268 Class => |
SUCCESS | 0x00000000 | |
| 09:18:04,751 | 1640 | NtCreateKey |
ObjectAttributes => Software\Adobe\Acrobat Reader\11.0\ServicesRdr DesiredAccess => 196639 KeyHandle => 0x00000268 Class => |
SUCCESS | 0x00000000 | |
| 09:18:04,761 | 1640 | NtCreateKey |
ObjectAttributes => cInstallTypes DesiredAccess => 196639 KeyHandle => 0x00000268 Class => |
SUCCESS | 0x00000000 | |
| 09:18:04,961 | 1640 | NtCreateKey |
ObjectAttributes => Software\Adobe\Acrobat Reader\11.0\ServicesRdr DesiredAccess => 196639 KeyHandle => 0x00000268 Class => |
SUCCESS | 0x00000000 | |
| 09:18:04,961 | 1640 | NtCreateKey |
ObjectAttributes => cInstallTypes DesiredAccess => 196639 KeyHandle => 0x00000268 Class => |
SUCCESS | 0x00000000 | |
| 09:18:05,001 | 1640 | NtCreateKey |
ObjectAttributes => Software\Adobe\Acrobat Reader\11.0\ServicesRdr DesiredAccess => 196639 KeyHandle => 0x00000268 Class => |
SUCCESS | 0x00000000 | |
| 09:18:05,001 | 1640 | NtCreateKey |
ObjectAttributes => cInstallData DesiredAccess => 196639 KeyHandle => 0x00000268 Class => |
SUCCESS | 0x00000000 | |
| 09:18:05,001 | 1640 | NtCreateKey |
ObjectAttributes => ccom_2E_adobe_2E_acrobat_2E_extensions_2E_files_5F_11_2E_0_2E_7_2E_0 DesiredAccess => 196639 KeyHandle => 0x00000268 Class => |
SUCCESS | 0x00000000 | |
| 09:18:05,011 | 1640 | NtCreateKey |
ObjectAttributes => Software\Adobe\Acrobat Reader\11.0\ServicesRdr DesiredAccess => 196639 KeyHandle => 0x00000268 Class => |
SUCCESS | 0x00000000 | |
| 09:18:05,011 | 1640 | NtCreateKey |
ObjectAttributes => cInstallData DesiredAccess => 196639 KeyHandle => 0x00000268 Class => |
SUCCESS | 0x00000000 | |
| 09:18:05,011 | 1640 | NtCreateKey |
ObjectAttributes => ccom_2E_adobe_2E_acrobat_2E_extensions_2E_files_5F_11_2E_0_2E_7_2E_0 DesiredAccess => 196639 KeyHandle => 0x00000268 Class => |
SUCCESS | 0x00000000 | |
| 09:18:05,011 | 1640 | NtCreateKey |
ObjectAttributes => Software\Adobe\Acrobat Reader\11.0\ServicesRdr DesiredAccess => 196639 KeyHandle => 0x00000268 Class => |
SUCCESS | 0x00000000 | |
| 09:18:05,011 | 1640 | NtCreateKey |
ObjectAttributes => cInstallTypes DesiredAccess => 196639 KeyHandle => 0x00000268 Class => |
SUCCESS | 0x00000000 | |
| 09:18:05,101 | 1640 | NtOpenKey |
DesiredAccess => 65547 KeyHandle => 0x00000268 ObjectAttributes => Software\Adobe\Adobe Synchronizer\11.0 |
SUCCESS | 0x00000000 | |
| 09:18:05,101 | 1640 | NtCreateKey |
ObjectAttributes => Software\Adobe\Adobe Synchronizer\11.0\Acrobat.com DesiredAccess => 65547 KeyHandle => 0x00000268 Class => |
SUCCESS | 0x00000000 | |
| 09:18:05,101 | 1640 | NtCreateKey |
ObjectAttributes => Software\Adobe\Adobe Synchronizer\11.0\Acrobat.com.v2 DesiredAccess => 65547 KeyHandle => 0x00000268 Class => |
SUCCESS | 0x00000000 | |
| 09:18:05,111 | 1640 | NtCreateKey |
ObjectAttributes => Software\Adobe\Adobe Synchronizer\11.0\CredentialsV2 DesiredAccess => 65547 KeyHandle => 0x00000268 Class => |
SUCCESS | 0x00000000 | |
| 09:18:05,131 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002021a8 | |
| 09:18:05,131 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002021a8 | |
| 09:18:05,131 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002021a8 | |
| 09:18:05,131 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002021a8 | |
| 09:18:05,131 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000264 |
SUCCESS | 0x00000000 | |
| 09:18:05,131 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000268 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:05,141 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002021a8 | |
| 09:18:05,141 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002021a8 | |
| 09:18:05,141 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002021a8 | |
| 09:18:05,141 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002021a8 | |
| 09:18:05,141 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000264 |
SUCCESS | 0x00000000 | |
| 09:18:05,141 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000268 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:05,141 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002021a8 | |
| 09:18:05,141 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002021a8 | |
| 09:18:05,141 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002021a8 | |
| 09:18:05,141 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002021a8 | |
| 09:18:05,141 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000264 |
SUCCESS | 0x00000000 | |
| 09:18:05,141 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000268 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:05,141 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002021a8 | |
| 09:18:05,141 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002021a8 | |
| 09:18:05,141 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002021a8 | |
| 09:18:05,141 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002021a8 | |
| 09:18:05,141 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000264 |
SUCCESS | 0x00000000 | |
| 09:18:05,141 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000268 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:05,141 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002021a8 | |
| 09:18:05,141 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002021a8 | |
| 09:18:05,141 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002021a8 | |
| 09:18:05,141 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002021a8 | |
| 09:18:05,141 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000264 |
SUCCESS | 0x00000000 | |
| 09:18:05,141 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000268 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:05,151 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002021a8 | |
| 09:18:05,151 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002021a8 | |
| 09:18:05,151 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002021a8 | |
| 09:18:05,151 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002021a8 | |
| 09:18:05,151 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000264 |
SUCCESS | 0x00000000 | |
| 09:18:05,151 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000268 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:05,151 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002021a8 | |
| 09:18:05,151 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002021a8 | |
| 09:18:05,151 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002021a8 | |
| 09:18:05,151 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002021a8 | |
| 09:18:05,151 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000264 |
SUCCESS | 0x00000000 | |
| 09:18:05,151 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000268 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:05,151 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002021a8 | |
| 09:18:05,151 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002021a8 | |
| 09:18:05,151 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002021a8 | |
| 09:18:05,151 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002021a8 | |
| 09:18:05,151 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000264 |
SUCCESS | 0x00000000 | |
| 09:18:05,151 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000268 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:05,852 | 1640 | NtOpenKey |
DesiredAccess => 131097 KeyHandle => 0x00000268 ObjectAttributes => \REGISTRY\USER\S-1-5-21-1935655697-1606980848-1060284298-1003 |
SUCCESS | 0x00000000 | |
| 09:18:05,852 | 1640 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x00000268 SubKey => SOFTWARE\Microsoft\Cryptography\Providers\Type 001 |
FAILURE | 0x00000002 | |
| 09:18:05,852 | 1640 | RegOpenKeyExA |
Handle => 0x00000268 Registry => 0x80000002 SubKey => SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types\Type 001 |
SUCCESS | 0x00000000 | |
| 09:18:05,852 | 1640 | RegQueryValueExA |
Handle => 0x00000268 DataLength => 40 ValueName => Name Type => 1 |
SUCCESS | 0x00000000 | |
| 09:18:05,862 | 1640 | RegQueryValueExA |
Handle => 0x00000268 Data => Microsoft Strong Cryptographic Provider\x00 ValueName => Name |
SUCCESS | 0x00000000 | |
| 09:18:05,862 | 1640 | RegCloseKey |
Handle => 0x00000268 |
SUCCESS | 0x00000000 | |
| 09:18:05,862 | 1640 | RegOpenKeyExA |
Handle => 0x00000268 Registry => 0x80000002 SubKey => SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Strong Cryptographic Provider |
SUCCESS | 0x00000000 | |
| 09:18:05,862 | 1640 | RegQueryValueExA |
Handle => 0x00000268 Data => 1 ValueName => Type |
SUCCESS | 0x00000000 | |
| 09:18:05,862 | 1640 | RegQueryValueExA |
Handle => 0x00000268 DataLength => 11 ValueName => Image Path Type => 1 |
SUCCESS | 0x00000000 | |
| 09:18:05,862 | 1640 | RegQueryValueExA |
Handle => 0x00000268 Data => rsaenh.dll\x00 ValueName => Image Path |
SUCCESS | 0x00000000 | |
| 09:18:05,862 | 1640 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => rsaenh.dll |
FAILURE | 3221225781 | 1 time |
| 09:18:05,862 | 1640 | NtOpenKey |
DesiredAccess => 1 KeyHandle => 0x0000026c ObjectAttributes => \Registry\MACHINE\System\CurrentControlSet\Control\Session Manager |
SUCCESS | 0x00000000 | |
| 09:18:05,862 | 1640 | NtQueryValueKey |
KeyHandle => 0x0000026c ValueName => SafeProcessSearchMode |
FAILURE | 3221225524 | |
| 09:18:05,862 | 1640 | NtCreateFile |
ShareAccess => 1 FileName => C:\WINDOWS\system32\rsaenh.dll DesiredAccess => 0x80100080 CreateDisposition => 1 FileHandle => 0x0000026c |
SUCCESS | 0x00000000 | |
| 09:18:05,862 | 1640 | NtQueryInformationFile |
FileHandle => 0x0000026c FileInformation => \x000\x03\x00\x00\x00\x00\x00\x00.\x03\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:18:05,862 | 1640 | NtCreateSection |
ObjectAttributes => DesiredAccess => 0x000f0005 SectionHandle => 0x00000270 FileHandle => 0x0000026c |
SUCCESS | 0x00000000 | |
| 09:18:05,862 | 1640 | ZwMapViewOfSection |
SectionOffset => 0x01fbf864 SectionHandle => 0x00000270 ProcessHandle => 0xffffffff BaseAddress => 0x01fc0000 |
SUCCESS | 0x00000000 | |
| 09:18:05,872 | 1640 | NtCreateFile |
ShareAccess => 1 FileName => C:\WINDOWS\system32\rsaenh.dll DesiredAccess => 0x80100080 CreateDisposition => 1 FileHandle => 0x0000026c |
SUCCESS | 0x00000000 | |
| 09:18:05,872 | 1640 | NtCreateSection |
ObjectAttributes => DesiredAccess => 0x000f0005 SectionHandle => 0x00000270 FileHandle => 0x0000026c |
SUCCESS | 0x00000000 | |
| 09:18:05,872 | 1640 | ZwMapViewOfSection |
SectionOffset => 0x01fbf8c8 SectionHandle => 0x00000270 ProcessHandle => 0xffffffff BaseAddress => 0x01fc0000 |
SUCCESS | 0x00000000 | |
| 09:18:05,872 | 1640 | NtReadFile |
Buffer => MZ\x90\x00\x03\x00\x00\x00\x04\x00\x00\x00\xff\xff\x00\x00\xb8\x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xf8\x00\x00\x00\x0e\x1f\xba\x0e\x00\xb4 \xcd!\xb8\x01L\xcd!This program cannot be run in DOS mode.
$\x00\x00\x00\x00\x00\x00\x00\x14_\xd9\x13P>\xb7@P>\xb7@P>\xb7@w\xf8\xda@H>\xb7@\x931\xb8@Y>\xb7@P>\xb6@\xc5>\xb7@\x931\xea@[>\xb7@\x931\xeb@Q>\xb7@\x931\xe9@Q>\xb7@\x931\xd7@Q>\xb7@\x931\xe8@\x7f>\xb7@\x931\xed@Q>\xb7@RichP>\xb7@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00PE\x00\x00L\x01\x04\x00 FileHandle => 0x0000026c |
SUCCESS | 0x00000000 | |
| 09:18:05,872 | 1640 | NtQueryInformationFile |
FileHandle => 0x0000026c FileInformation => P\x01\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:18:05,872 | 1640 | NtSetInformationFile |
FileHandle => 0x0000026c FileInformation => |
SUCCESS | 0x00000000 | |
| 09:18:05,872 | 1640 | NtReadFile |
Buffer => \x03\x00\x00\x00\x00\x00\x04\x00\x00\x10\x00\x00\x00\x00\x10\x00\x00\x10\x00\x00\x00\x00\x00\x00\x10\x00\x00\x000\xea\x02\x00\xbb\x02\x00\x00\xc4\xdd\x02\x00x\x00\x00\x00\x000\x03\x00P\x0c\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@\x03\x00\xc8\x10\x00\x00@\x12\x00\x00\x1c\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10e\x00\x00@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00\x008\x02\x00\x00\xbc\xdb\x02\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00.text\x00\x00\x00\xeb\xdc\x02\x00\x00\x10\x00\x00\x00\xde\x02\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00`.data\x00\x00\x00 0\x00\x00\x00\xf0\x02\x00\x00*\x00\x00\x00\xe2\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@\x00\x00\xc0.rsrc\x00\x00\x00P\x0c\x00\x00\x000\x03\x00\x00\x0e\x00\x00 FileHandle => 0x0000026c |
SUCCESS | 0x00000000 | |
| 09:18:05,872 | 1640 | NtReadFile |
Buffer => \x00\x04\x00\x08\x00\x00\x00\x08\x00\x04\x01\x00 \x04\x01\x08\x00\x00\x00\x00 \x04\x01\x00\x00\x00\x00\x08\x00\x04\x00\x00 \x00\x01\x00 \x04\x00\x08\x00\x04\x00\x00\x00\x00\x00\x00 \x04\x01\x08 \x00\x01\x08\x00\x04\x01\x08 \x04\x00\x00\x00\x00\x01\x00\x00\x04\x01\x00 \x00\x01\x08\x00\x04\x00\x08 \x04\x00\x00 \x00\x00\x00 \x04\x01\x00\x00\x00\x01\x08 \x00\x00\x08@\x00\x00\x80@\x00 \x00\x00\x00\x00\x00\x00 \x80@\x00 \x00\x00 \x00\x00@ \x00\x80\x00\x00 \x00@ \x00\x00@ \x80\x00 \x00\x00\x00\x00\x80\x00 \x00\x80@\x00\x00\x80\x00\x00 \x80@ \x00\x00\x00 \x00@ \x00\x80@\x00 \x80\x00\x00\x00\x00\x00 \x00\x00@\x00\x00\x00\x00 \x80@\x00 \x80@ \x80\x00\x00 \x80\x00\x00\x00\x80@ \x00\x00@\x00\x00\x00\x00 \x00@ \x00\x00 \x00\x80@ \x00\x00\x00\x00\x00\x80\x00 \x00\x80@ \x00\x00 \x80@\x00 \x00\x00\x00\x00\x00 FileHandle => 0x0000026c |
SUCCESS | 0x00000000 | |
| 09:18:05,872 | 1640 | NtReadFile |
Buffer => '\x9e\x9e\xb9\xd9\xe1\xe18\xeb\xf8\xf8\x13+\x98\x98\xb3"\x11\x113\xd2ii\xbb\xa9\xd9\xd9p\x07\x8e\x8e\x893\x94\x94\xa7-\x9b\x9b\xb6<\x1e\x1e"\x15\x87\x87\x92\xc9\xe9\xe9 \x87\xce\xceI\xaaUU\xffP((x\xa5\xdf\xdfz\x03\x8c\x8c\x8fY\xa1\xa1\xf8 \x89\x89\x80\x1a
\x17e\xbf\xbf\xda\xd7\xe6\xe61\x84BB\xc6\xd0hh\xb8\x82AA\xc3)\x99\x99\xb0Z--w\x1e\x0f\x0f\x11{\xb0\xb0\xcb\xa8TT\xfcm\xbb\xbb\xd6,\x16\x16:\xa5\xc6cc\x84\xf8||\x99\xeeww\x8d\xf6{{
\xff\xf2\xf2\xbd\xd6kk\xb1\xdeooT\x91\xc5\xc5P`00\x03\x02\x01\x01\xa9\xcegg}V++\x19\xe7\xfe\xfeb\xb5\xd7\xd7\xe6M\xab\xab\x9a\xecvvE\x8f\xca\xca\x9d\x1f\x82\x82@\x89\xc9\xc9\x87\xfa}}\x15\xef\xfa\xfa\xeb\xb2YY\xc9\x8eGG\x0b\xfb\xf0\xf0\xecA\xad\xadg\xb3\xd4\xd4\xfd_\xa2\xa2\xeaE\xaf\xaf\xbf#\x9c\x9c\xf7S\xa4\xa4\x96\xe4rr FileHandle => 0x0000026c |
SUCCESS | 0x00000000 | |
| 09:18:05,872 | 1640 | NtReadFile |
Buffer => m\xd6G\x13\x9a\xd7a\x8c7\xa1\x0czY\xf8\x14\x8e\xeb\x13<\x89\xce\xa9'\xee\xb7a\xc95\xe1\x1c\xe5\xedzG\xb1<\x9c\xd2\xdfYU\xf2s?\x18\x14\xceys\xc77\xbfS\xf7\xcd\xea_\xfd\xaa[\xdf=o\x14xD\xdb\x86\xca\xaf\xf3\x81\xb9h\xc4>8$4,\xc2\xa3@_\x16\x1d\xc3r\xbc\xe2%\x0c(<I\x8b\xff
\x95A9\xa8\x01q\x08\x0c\xb3\xde\xd8\xb4\xe4\x9cdV\xc1\x90{\xcb\x84a\xd52\xb6pHl\t\xd0\xb8WBPQ\xf4\xa7S~Ae\xc3\x1a\x17\xa4\x96:'^\xcb;\xabk\xf1\x1f\x9dE\xab\xac\xfaX\x93K\xe3\x03U 0\xfa\xf6\xadvm\x91\x88\xccv%\xf5\x02L\xfcO\xe5\xd7\xd7\xc5*\xcb\x80&5D\x8f\xb5b\xa3I\xde\xb1Zg%\xba\x1b\x98E\xea\x0e\xe1]\xfe\xc0\x02\xc3/u\x12\x81L\xf0\xa3\x8dF\x97\xc6k\xd3\xf9\xe7\x03\x8f_\x95\x15\x92\x9c\xeb\xbfmz\xda\x95RY-\xd4\xbe\x83\xd3Xt!)I\xe0i FileHandle => 0x0000026c |
SUCCESS | 0x00000000 | |
| 09:18:05,872 | 1640 | NtReadFile |
Buffer => \xfb\x0bA.\x9a\xd7a\x8c\x94\xdel\x87\x86\xc5{\x9a\x88\xccv\x91\xa2\xf3U\xa0\xac\xfaX\xab\xbe\xe1O\xb6\xb0\xe8B\xbd\xea\x9f \xd4\xe4\x96\x04\xdf\xf6\x8d\x13\xc2\xf8\x84\x1e\xc9\xd2\xbb=\xf8\xdc\xb20\xf3\xce\xa9'\xee\xc0\xa0*\xe5zG\xb1<tN\xbc7fU\xab*h\\xa6!Bc\x85\x10Lj\x88\x1b^q\x9f\x06Px\x92
\x0f\xd9d\x04\x06\xd4o\x16\x1d\xc3r\x18\x14\xcey2+\xedH<"\xe0C.9\xf7^ 0\xfaU\xec\x9a\xb7\x01\xe2\x93\xba
\xf0\x88\xad\x17\xfe\x81\xa0\x1c\xd4\xbe\x83-\xda\xb7\x8e&\xc8\xac\x99;\xc6\xa5\x940\x9c\xd2\xdfY\x92\xdb\xd2R\x80\xc0\xc5O\x8e\xc9\xc8D\xa4\xf6\xebu\xaa\xff\xe6~\xb8\xe4\xf1c\xb6\xed\xfch\x0c
g\xb1\x02\x03j\xba\x10\x18}\xa7\x1e\x11p\xac4.S\x9d:'^\x96(<I\x8b&5D\x80|B\x0f\xe9rK\x02\xe2`P\x15\xffnY\x18\xf4Df;\xc5Jo6\xceXt!\xd3 FileHandle => 0x0000026c |
SUCCESS | 0x00000000 | |
| 09:18:05,872 | 1640 | NtReadFile |
Buffer => \xce>'\xca\x07\xc2\xc0!\xc7\xb8\x86\xd1\x1e\xeb\xe0\xcd\xd6}\xda\xeax\xd1n\xee\x7fO}\xf5\xbao\x17r\xaag\xf0\x06\xa6\x98\xc8\xa2\xc5}c
\xae
\xf9\xbe\x04\x98?\x11\x1bG\x1c\x135\x0bq\x1b\x84}\x04#\xf5w\xdb(\x93$\xc7@{\xab\xca2\xbc\xbe\xc9\x15
\xbe\x9e<L
\x10\x9c\xc4g\x1dC\xb6B>\xcb\xbe\xd4\xc5L*~e\xfc\x9c)\x7fY\xec\xfa\xd6:\xabo\xcb_\x17XGJ\x8c\x19Dl\x98/\x8aB\x91D7q\xcf\xfb\xc0\xb5\xa5\xdb\xb5\xe9[\xc2V9\xf1\x11\xf1Y\xa4\x82?\x92\xd5^\x1c\xab\x98\xaa\x07\xd8\x01[\x83\x12\xbe\x851$\xc3}\x0cUt]\xber\xfe\xb1\xde\x80\xa7\x06\xdc\x9bt\xf1\x9b\xc1\xc1i\x9b\xe4\x86G\xbe\xef\xc6\x9d\xc1\x0f\xcc\xa1\x0c$o,\xe9-\xaa\x84tJ\xdc\xa9\xb0\\xda\x88\xf9vRQ>\x98m\xc61\xa8\xc8'\x03\xb0\xc7\x7fY\xbf\xf3\x0b\xe0\xc6G\x91\xa7\xd5Qc\xca\x06g))\x14\x85
\xb7' FileHandle => 0x0000026c |
SUCCESS | 0x00000000 | |
| 09:18:05,872 | 1640 | NtReadFile |
Buffer => \x00\x00\x00\xffu\x18\xffu\x14\xffu\x10\xffvxVh\x90\x98\x01h\xe8\xcb\xf9\xff\xff\x85\xc0\x0f\x85\xc0\x00\x00\x009E\x10\x0f\x84\xb5\x00\x00\x00\x8bE\x0c\x85\xc0\x0f\x84\xaa\x00\x00\x00\x81x\x04\x05\x80\x00\x00\x0f\x85\x9d\x00\x00\x00\x83~`\x01\x0f\x85\x93\x00\x00\x00\x8bNxW\x8bx\x10\x8b\xd1\x83\xc7\x04\xc1\xe9\x02\x83\xc6,\xf3\xa5\x8b\xca\x83\xe1\x03\xf3\xa4_\xebq\xb8\x08\x00 \x80\xebp\xffu\x18\xffu\x14\xffu\x10j\x08Vh\xa0t\x01h\xeb$\xffu\x18\xffu\x14\xffu\x10j\x08Vh\xd0f\x01h\xeb\x11\xffu\x18\xffu\x14\xffu\x10j\x08Vh V\x01h\xe87\xf9\xff\xff\x85\xc0u09E\x10t)\x8bE\x0c\x85\xc0t"\x81x\x04\x05\x80\x00\x00u\x19\x83~`\x01u\x13\x8bV,\x8bH\x10\x89Q\x04\x8bV0\x89Q\x08\x83H4\x013\xc0^]\xc2\x14\x00\xcc\xcc\xcc\xcc\xcc\x8b\xffU\x8b\xec\x83\xec\x14V3\xf6\xf7E\x18\xbf\xff\xff\xff\x89u FileHandle => 0x0000026c |
SUCCESS | 0x00000000 | |
| 09:18:05,872 | 1640 | NtReadFile |
Buffer => v\x81\xf9\x02f\x00\x00tX\x81\xf9\x03f\x00\x00t:\x81\xf9 f\x00\x00t2\x81\xf9
f\x00\x00vl\x81\xf9\x10f\x00\x00wd\xffu\x14\x8dM\xf0Q\xffu\xf4j\x00\xffpxPh\x90\x98\x01h\xe8\xfe\xe7\xff\xff\x85\xc0tF\x8b\xf0\xebf\xffu\x14\x8dM\xf0Q\xffu\xf4j\x00j\x08Ph\xa0t\x01h\xeb\xdd\xffu\x14\x8dM\xf0Q\xffu\xf4j\x00j\x08Ph\xd0f\x01h\xeb\xc7\xffu\x14\x8dM\xf0Q\xffu\xf4j\x00j\x08Ph V\x01h\xeb\xb1\x8bu\xf0\x8bE\x10\x8bU\xec\x03\xf2\x8b\xc8\x8b\xd1\xc1\xe9\x02\x8d{\x14\xf3\xa5\x8b\xca\x83\xe1\x03\xf3\xa4\x89\x033\xff3\xf6\x83}\xf4\x00t\x08\xffu\xf4\xe8\xf0\xa0\x01\x00\x8bE\xfc\x85\xc0t\x12\x83\xc0\xf8\x818Heapu\x07P\xff\x15\x1c \x03h\x8bE\xf8\x85\xc0t\x12\x83\xc0\xf8\x818Heapu\x07P\xff\x15\x1c \x03h\x8b\xc6\x8de\xe0_^[\xc9\xc2\x10\x00\xcc\xcc\xcc FileHandle => 0x0000026c |
SUCCESS | 0x00000000 | |
| 09:18:05,872 | 1640 | NtReadFile |
Buffer => \xe9\x02\xf3\xa5\x8b\xc8\x8bE\xfc\x83\xe1\x03\xf3\xa4\x8bu\x08\x03\xc3\x01E\x14\x8b}\x14\x8b\xcb\x8b\xc1\xc1\xe9\x02\xf3\xa5\x8b\xc8\x8bE\x08\x83\xe1\x03\xf3\xa4\x8bJ\x04\x8d4\x18\x8bE\x14\xc1\xe9\x03\x8d<\x18\x03}\xfc\x8b\xc1\xc1\xe9\x02\xf3\xa5\x8b\xc8\x8bE\xf4\x83\xc0\xecP\xffu\x0c\x83\xe1\x03\xf3\xa4\xe8\x9f\x91\x01\x00\x85\xc0t\x043\xc0\xeb&\x8b}\xf0\x8bu\xf43\xc0@\x8bM\x18\x899\x8bM\x10\x891\xeb\x113\xc0\xeb\xf0\x8bE\x18\x898\x8bE\x10\x8903\xc0@_[^\xc9\xc2\x14\x00\xcc\xcc\xcc\xcc\xcc\x8b\xffU\x8b\xec\x8bE\x0c%\x00\xe0\x00\x00=\x00\x80\x00\x00u\x043\xc0\xeb\x1a\x8bE\x08\x8b\x80\x84\x01\x00\x00j\x00\xffu\x0c\xff4\x85(\x18\x03h\xe8c\xe1\x01\x00]\xc2\x08\x00\xcc\xcc\xcc\xcc\xcc\x8b\xffU\x8b\xec\x8bE\x0c\x8bM\x14W3\xff-\x00$\x00\x00\x899t\x19-\x01(\x00\x00td\x83\xe8\x03tTHtFHtY-\xfaW\x00\x00u\x06 FileHandle => 0x0000026c |
SUCCESS | 0x00000000 | |
| 09:18:05,872 | 1640 | NtReadFile |
Buffer => \xfa\x10f\x00\x00w\x05\x8bIx\xeb\x8a\x83&\x00\xebA\xc7\x06@\x00\x00\x00\xeb9\x8bM\x1c\x8bI\x10\x85\xc9u\x07\xb9
\x00 \x80\xeb:\x8bI\x08\x89\x0e\xeb!\xf7\xde\x1b\xf6\x81\xe6\xea\x00\x00\x00\x8b\xce\xeb#\x8bM\x14\x85\xc9t\x129\x18r\x0e\x8bU\x1c\x8bR\x04\x89\x11\x89\x183\xc9\xeb\x0c\xf7\xd9\x1b\xc9\x81\xe1\xea\x00\x00\x00\x89\x18_[3\xc0\x85\xc9\x0f\x94\xc0\x8b\xf0\x85\xf6u\x07Q\xff\x15\xc4\x11\x00h\x8b\xc6^]\xc2\x18\x00\xcc\xcc\xcc\xcc\xcc\x8b\xffU\x8b\xecSV\x8bu\x083\xc0\xf6\x06 Wt\x01@\x83}\x0c\x02u\x13\xbb\x84\x12\x00h\xbf|\x12\x00h\xc7E\x08t\x12\x00h\xeb\x17\x83}\x0c\x01uP\xbbl\x12\x00h\xbfd\x12\x00h\xc7E\x08\\x12\x00h\x83\xbeX\x01\x00\x00\x00t\x15j\x00P\xffu\x0ch\xb0\x1a\x03hV\xe8\xcb\xab\x00\x00\x85\xc0u&W\x8b=\xc4\x10\x00h\x81\xc6@\x01\x00\x00\xff6\xff\xd7\xffu\x08\xff6\xff\xd7S FileHandle => 0x0000026c |
SUCCESS | 0x00000000 | |
| 09:18:05,872 | 1640 | NtReadFile |
Buffer => \x8bu \x85\xf6t\x1d3\xc9;\xc1v\x17\x8dE\xdc+\xf0\x8dD
\xdc\x8a\x1c\x060\x18A;M\x18r\xf1\x8b]\xd8\x8b}\x08\x81\xff\x01f\x00\x00\x0f\x84\xf1\x00\x00\x00\x81\xff\x02f\x00\x00\x0f\x84\xbc\x00\x00\x00\x81\xff\x03f\x00\x00\x0f\x84\x87\x00\x00\x00\x81\xff f\x00\x00t\x7f\x81\xff
f\x00\x00vm\x81\xff\x10f\x00\x00v6;\xfaua\x8bM\x18\x8bu\xd0\x8b\xc1\xc1\xe9\x02\x83}$\x01\x8d}\xect\x03\x8bu\xd4\xf3\xa5\x8b\xc8\x8dE\xecP\xffu\x18\x83\xe1\x03S\xf3\xa4\xe8\x18\xec\x00\x00\xe9\xb2\x00\x00\x00\x83}$\x01u\x15j\x01S\x8dE\xdcP\x8dE\xecP\xe8\x8d\xea\x00\x00\xe9\x9d\x00\x00\x00j\x00S\xffu\xd4\x8dE\xecP\xe8y\xea\x00\x00\xe9\x83\x00\x00\x00\xbe\x08\x00 \x80\xe9\xc7\x00\x00\x00\x83}$\x01u\x12j\x01S\x8dE\xdcP\x8dE\xecP\xe8d\xc6\x00\x00\xebgj\x00S\xffu\xd4\x8dE\xecP\xe8S\xc6\x00\x00\xebP\x83}$\x01u FileHandle => 0x0000026c |
SUCCESS | 0x00000000 | |
| 09:18:05,872 | 1640 | NtReadFile |
Buffer => \x01\x00\x00\x8dE\xf4PV\xffu\x18\xe8\xcd\xcb\xff\xff\x85\xc0\x0f\x84D\x01\x00\x009u\xf0\x8bE\xf4\x8bM\x14\x8d<\x01u\x17W\xe8@a\x01\x00\x8b\xd8;\xde\x89]\xecu\x11j\x08^\xe9\xb6\x01\x00\x00\x8b]\xf8\x83\xc3\x08\x89]\xec\x8dE\xf4PS\xffu\x18\xe8\x8a\xcb\xff\xff\x85\xc0\x0f\x84\x01\x01\x00\x009u\x10t\x1eVW\x8dE\xf4PSVj\x01V\xffu\x10\xffu\x08\xe8\xd4\xab\xff\xff;\xc6\x0f\x85\xb8\xfd\xff\xff\x83}\xf0\x00\x8bM\xf4\x8dY\x08\x0f\x85<\x01\x00\x00\x8b}\x1c\x8bu\xec\x83\xc7\x08\xe96\x01\x00\x00\x8a\x06<\x03t\x08<\x04\x0f\x85\xb2\x00\x00\x00\x8bE\xfc\x8b@\x10\x85\xc0\x0f\x84\xb8\x00\x00\x00\x8bX\x08\x8bu\x1c\x83\xc3\x07\xc1\xeb\x03\x83\xc3\x14\x85\xf6\x0f\x84\x15\x01\x00\x00\x8bM 9\x19\x0f\x82
\x01\x00\x00\x8b\x08\x8bU\xf8\x89J\x08\x8bH\x08\x89J\x0c\x8bH\x10\x89J\x10\x8bH\x08\x83\xc1\x07\xc1\xe9\x03\x8dp\x14\x8b\xc1\xc1\xe9\x02\x8d FileHandle => 0x0000026c |
SUCCESS | 0x00000000 | |
| 09:18:05,872 | 1640 | NtReadFile |
Buffer => k\x83E\x90\x08u2\x8b\xb5|\xff\xff\xff\x8dF\x08;\xc6r\x18P\xff\x15\x18 \x03h;\xc7\x89E\x90t\x0f\xc7\x00Heap\x83E\x90\x089}\x90u\x08j\x08[\xe9\x85\x02\x00\x00\x8d\x85|\xff\xff\xffP\x8dE\x90P\x8bE\x94\xffp\x1c\xe8\x8d\xa5\xff\xff;\xc7\x0f\x85c\xfc\xff\xff\xffu\x88\x8bE\x94\xffu\x98\xffu\x90\xffp\x1c\xe8x\xa9\xff\xff;\xc7\x0f\x85G\xfc\xff\xff\xff\xb5t\xff\xff\xff\x8dE\x9cP\xffu\x90\x8bE\x94\xffp\x1c\xe8X\xa9\xff\xff;\xc7\x0f\x85'\xfc\xff\xff\x8bE\x94\x8bx\x10\x8b\x8d|\xff\xff\xff\x8bu\x90\x8b\xc1\xc1\xe9\x02\xf3\xa5\x8b\xc8\x83\xe1\x03\xf3\xa4\x8bE\x94\x83H \x02\x8bM\x80\x8b}\x8c\x8b\xd1\xc1\xe9\x02\x8b\xb5x\xff\xff\xff3\xc0\xf3\xab\x8b\xca\x83\xe1\x03\xf3\xaa\x8bM\x88\x8b}\x98\x8b\xd1\xc1\xe9\x023\xc0\xf3\xab\x8b\xca\x83\xe1\x03\xf3\xaa\x8bE\x94VS\xffp\x10\xffp\x18\xffp\x1c\xe8\x94\xf8\xff\xff\x85\xc0\xe9\xb1 FileHandle => 0x0000026c |
SUCCESS | 0x00000000 | |
| 09:18:05,872 | 1640 | NtReadFile |
Buffer => \xeb\x07\xc7E\xb8p\xf0\x02h\x8bU\x143\xf6\x85\xd2v\x13\x8bE\x10\x8dD\x10\xff\x8a\x08\x88L5\xbcFH;\xf2r\xf4\x8b]\x1c\x8b\xca\x8b\xfb\x8du\xbc3\xc0\xf3\xa6t\x05\x1b\xc0\x83\xd8\xff\x85\xc0u~\xf6E\x18\x01\x8b\xca\x89M\xb4uG\x8bu\xb8\x85\xf6t@\x8b\x06\x808\x00t9\x89u\xb8\x0f\xb6\x18\x8dx\x01\x8bE\x1c\x8d4\x02\x8b\xcb3\xc0\xf3\xa6t\x05\x1b\xc0\x83\xd8\xff\x85\xc0t\x13\x83E\xb8\x04\x8bE\xb8\x8b\x00\x808\x00u\xd5\x8bM\xb4\xeb\x03\x8d\x0c\x13\x8b]\x1c\x80<\x19\x00u&\x8bE\x08\x8b@\x0c\x80<\x18\x00u\x1a\x80|\x18\xff\x01u\x13AH\xeb\x07\x80<\x19\xffu A;\xc8r\xf53\xc0\xeb\x0c\xb8\x06\x00 \x80\xeb\x05\xb8\x02\x00 \x80\x8bM\xfc_^[\xe8\x92n\x00\x00\xc9\xc2\x18\x00\x10\xdd\x00h\x19\xdd\x00h"\xdd\x00h+\xdd\x00h\x17\xde\x00h\x17\xde\x00h\x17\xde\x00h4\xdd\x00h\x17\xde\x00h\x17\xde\x00h\x17 FileHandle => 0x0000026c |
SUCCESS | 0x00000000 | |
| 09:18:05,872 | 1640 | NtReadFile |
Buffer => _j\x06\x8dM\xc0Q\x8dM\xe4Q\xffu\xc8\x89}\xc0P\xffU\xb8;\xc3u\x06f9}\xc0t8\x83\xf82\x8bu\xcctSW\x8dE\xe4P\x8dF8P\x8dFXP\x8d\x86d\x01\x00\x00P\xe8\xb7\xe9\xff\xff;\xc3uSSj\x06W\x8dE\xe4P\xffu\xc8\xffu\xd4\xffU\xc4\xeb\x03\x8bu\xccW\xe8\x0c1\x01\x00;\xc3\x89\x86H\x01\x00\x00u\x08j\x08^\xe9\x1a\x01\x00\x00\x8du\xe4\xe9\xff\x00\x00\x00\x8dE\xd8PSSh\x03\x80\x00\x00\xffv\x0c\xe8\xd9\x86\xff\xff\x85\xc0u
\xff\x15\xc8\x11\x00h\x8b\xf0\xe9\xee\x00\x00\x00S\x8dE\xecPj\x02\xffu\xd8\xffv\x0c\xe8k\xb7\xff\xff\x85\xc0t\xdd\x8dE\xbcPj\x01\xffv\x0c\xffu\xd8\xe8\xf0$\x00\x00;\xc3t\x11= \x00 \x80u\xc7\xbe\x02\x00 \x80\xe9\xb2\x00\x00\x00\x8bE\xbc\xffu\xd0\x8b=\xbc\x11\x00h\x83`\x18\xfe\xff\xd7@P\xe8y0\x01\x00;\xc3\x89E\xe0tw\xffu\xd0P\xff\x15 FileHandle => 0x0000026c |
SUCCESS | 0x00000000 | |
| 09:18:05,872 | 1640 | NtReadFile |
Buffer => \xff\xff\xff6\xe8\xcc!\x01\x00\x8bu\x18\x89\x06\x8bE\x10\xff0\xe8T!\x01\x00;\xc3\x89\x07\x0f\x84r\xff\xff\xff\xff6\xe8C!\x01\x00;\xc3\x8bM\x0c\x89\x01\x0f\x84^\xff\xff\xff\xffu\xf0\xffu\xf8h\x01\x00\x01\x00\xffu\x1cP\xff7\xe8 \xfc\x00\x00\x8b\xf0\xf7\xde\x1b\xf6\x81\xe6\xb1\xfa\xff\xff\x81\xc6O\x05\x00\x00\x8dE\xdcP\x8d\x85p\xff\xff\xffP\xe8\xfbz\x01\x00\x85\xc0u\x0e;\xf3u
\xffu\xe4\xe8\xf6F\x00\x00\x8b\xf09]\xd0t"\x8dE\xdcP\x8d\x85\xc0\xfe\xff\xffP\xe8\xaev\x01\x00\x85\xc0u\x0e;\xf3u
\xffu\xe4\xe8\xcfF\x00\x00\x8b\xf09]\xect\x08\xffu\xec\xe8\xfb \x01\x009]\xf8t\x08\xffu\xf8\xe8\xee \x01\x009]\xf0t\x08\xffu\xf0\xe8\xe1 \x01\x00;\xf3t\x1b\x8b?;\xfbt\x06W\xe8\xd1 \x01\x00\x8bE\x0c\x8b\x00;\xc3t\x06P\xe8\xc2 \x01\x00_\x8b\xc6^[\xc9\xc2\x18\x00\xcc\xcc\xcc\xcc\xcc\x8b\xffU\x8b\xec FileHandle => 0x0000026c |
SUCCESS | 0x00000000 | |
| 09:18:05,872 | 1640 | NtReadFile |
Buffer => \xdbC\x89]\xa8\x8bE\x18=\x00\x04\x00\x00r0P\x8dE\xccP\x8dE\xc8P\x8dE\xc4P\x8dE\xdcP\x8dE\xe0P\xe8\\xee\xff\xff\x89E\xe4\x85\xc0\x0f\x85\xfd\x01\x00\x00\x89]\xd0\x8b}\xdc\xe9\x8f\x00\x00\x00\x89E\xa4\x8dE\xa4P\x8dE\xc8P\x8dE\xc4P\xe8\xa9\xef\x00\x00\x85\xc0u\x0c\xc7E\xe4 \x00 \x80\xe9\xce\x01\x00\x00\xffu\xc4\xe8\x01\x11\x01\x00\x89E\xe0\x85\xc0u\x0c\xc7E\xe4\x08\x00\x00\x00\xe9\xb3\x01\x00\x00\x89]\xd0\xffu\xc8\xe8L\x11\x01\x00\x89E\xccP\xe8\xda\x10\x01\x00\x8b\xf8\x89}\xdc\x85\xfft\xd7\x8d\x86d\x01\x00\x00\x838\xfft\x10\x89E\x90\xc7E\x94o\xd7\x00h\x8dE\x90\x89E\xc0h\x01\x00\x01\x00\xffu\x18W\xffu\xe0\xffu\xc0\xe8\xf2\xe8\x00\x00\x85\xc0t\x89\x8bE\xcc\x83\xc0\xecP\x8dG\x14P\xe8\x1c\x11\x01\x00\x89E\xd8\x85\xc0\x0f\x85E\x01\x00\x00PSSW\xffu\xe0\xe8s\xfc\xff\xff\x89E\xd8\x85\xc0\x0f\x85.\x01\x00\x00 FileHandle => 0x0000026c |
SUCCESS | 0x00000000 | |
| 09:18:05,872 | 1640 | NtReadFile |
Buffer => \x85\xe2\x00\x00\x00\xe8\x1f\xf7\xff\xff\x85\xc0\x0f\x84\xd5\x00\x00\x00\x8d\x85\xa4\xfe\xff\xffP\xe8\x8e\x80\x00\x00j\x03h\x1c\xf8\x02h\x8d\x85\xa4\xfe\xff\xffP\xe8K\x8c\x00\x00\x8d\x85|\xff\xff\xffP\x8d\x85\xa4\xfe\xff\xffP\xe8h\x8d\x00\x00\x8b\xcb\xbf \xf8\x02h\x8d\xb5|\xff\xff\xff3\xc0\xf3\xa7\x0f\x85\x8c\x00\x00\x00\x8d\x85\xd4\xfd\xff\xffP\xe85\x8e\x00\x00j\x03h@\xf8\x02h\x8d\x85\xd4\xfd\xff\xffP\xe8R\xbd\x00\x00\x8d\x85L\xff\xff\xffP\x8d\x85\xd4\xfd\xff\xffP\xe8\xbf\xc5\x00\x00j\x0cY\xbfD\xf8\x02h\x8d\xb5L\xff\xff\xff3\xc0\xf3\xa7uF\x8d\x85\x04\xfd\xff\xffP\xe8\x7f\x8e\x00\x00j\x03ht\xf8\x02h\x8d\x85\x04\xfd\xff\xffP\xe8\x0c\xbd\x00\x00\x8d\x85\x0c\xff\xff\xffP\x8d\x85\x04\xfd\xff\xffP\xe8Y\xbe\x00\x00j\x10Y\xbfx\xf8\x02h\x8d\xb5\x0c\xff\xff\xff3\xc0\xf3\xa7t
\xb8 \x00 \x80\xe9\xfa\x01\x00\x00j\x00h\x8c\xf6\x02hj\x05h\x84\xf6\x02hj FileHandle => 0x0000026c |
SUCCESS | 0x00000000 | |
| 09:18:05,872 | 1640 | NtReadFile |
Buffer => \x04\x00\x00\x8br\x10\x8b\xd1\xc1\xe9\x02\x8d\xb80\x03\x00\x00\xf3\xa5\x8b\xca\x83\xe1\x03\xf3\xa4\x8b\x8bH\x03\x00\x00\x89H\x04\x8b\x8bL\x03\x00\x00\x89H\x08\x8b\x8bP\x03\x00\x00\x89H\x0c\x8b\x8bT\x03\x00\x00\x89H\x10\x8b\x8bX\x03\x00\x00\x89H\x14\x8b\x8b\\x03\x00\x00\x89H\x18\x8b\x8b4\x01\x00\x00\x89\x88\x1c\x01\x00\x00\x8b\xd1\xc1\xe9\x02\x8ds4\x8dx\x1c\xf3\xa5\x8b\xca\x83\xe1\x03\xf3\xa4\x8b\x8b8\x02\x00\x00\x89\x88 \x02\x00\x00\x8b\xd1\xc1\xe9\x02\x8d\xb38\x01\x00\x00\x8d\xb8 \x01\x00\x00\xf3\xa5\x8b\xca\x83\xe1\x03\xf3\xa4\x8b\x8bD\x03\x00\x00\x89\x88,\x03\x00\x00\x8d\xb8,\x02\x00\x00\x8b\xc1\xc1\xe9\x02\x8d\xb3D\x02\x00\x00\xf3\xa5\x8b\xc8\x83\xe1\x03\xf3\xa4\xe9\x1b\x02\x00\x00\x8bJ\x0c\x89\x880\x04\x00\x00\x8br\x10\x8b\xd1\xc1\xe9\x02\x8d\xb80\x03\x00\x00\xf3\xa5\x8b\xca\x83\xe1\x03\xf3\xa4\x8b\x8bH\x03\x00\x00\x89H\x04\x8b\x8bL\x03\x00\x00\x89H\x08\x8b\x8bP\x03\x00\x00\x89H\x0c\x8b\x8bT\x03 FileHandle => 0x0000026c |
SUCCESS | 0x00000000 | |
| 09:18:05,872 | 1640 | NtReadFile |
Buffer => \x00+\xc1\x89u\xcc\x89U\xd8\x89U\xd0\x89U\xc4\x89U\xc0\x0f\x84H\x01\x00\x00\x83\xe8\x04t
\xbe\x08\x00 \x80\xe9\x97\x01\x00\x00\xf6\x834\x04\x00\x00\x01\x8b{\x0c\x8bC\x04\x89}\xd4\x89E\xc8\x0f\x84\xcd\x00\x00\x00\xffu\x14\x8dE\xf4P\x8dE\xd0P\x8dE\xdcP\x8dE\xccP\x8dE\xd4P\x8dE\xc4PS\xe8<\xfe\xff\xff\x85\xc0\x0f\x852\x01\x00\x00\x8bE\xcc\xf6E\x14\x01t\x07\xc7E\xc0\x01\x00\x00\x00\x8dM\xd8Qj\x01j\x00P\xff6W\xffu\xc0\xffu\xc8\xe8\xf8G\xff\xff\x85\xc0\x0f\x85\x03\x01\x00\x00\x81}\xc8\x02f\x00\x00u
\x8bE\xd8\xc7@l\x80\x00\x00\x00\x8b}\xd8\x8bM\xd0\x8b\xc1\xc1\xe9\x02\x83\xc7D\x8du\xdc\xf3\xa5\x8b\xc8\x83\xe1\x03\xf3\xa4\x8bE\xd8\x8bM\xd0\x89H@\x8b[\x18\x85\xdbt\x19\x8b}\xd8\x8b\xcb\x8b\xc1\xc1\xe9\x02\x83\xc7\x1c\x8du\xf4\xf3\xa5\x8b\xc8\x83\xe1\x03\xf3\xa4j\x00\xffu\xd8\xffu\xbc\xe8\xdbI\xff\xff\x85\xc0\x0f\x85\x85 FileHandle => 0x0000026c |
SUCCESS | 0x00000000 | |
| 09:18:05,872 | 1640 | NtReadFile |
Buffer => \x8b@\xfc\x89\x85\xdc\xfd\xff\xffj\x14Y3\xc0\x8d\xbd\xd0\xfc\xff\xff\xf3\xab\xc7\x85\xd0\xfc\xff\xff \x04\x00\xc0\x8bE\x04\x89\x85\xdc\xfc\xff\xff\x8d\x85\xd0\xfc\xff\xff\x89E\xf8\x8d\x85(\xfd\xff\xff\x89E\xfc\xa1\x84\x18\x03h\x89\x85 \xfd\xff\xff\xa1\x80\x18\x03h\x89\x85$\xfd\xff\xffj\x00\xff\x15\xd4\x10\x00h\x8dE\xf8P\xff\x15\xd8\x10\x00hh\x02\x05\x00\x00\xff\x15\xdc\x10\x00hP\xff\x15\xe0\x10\x00h_\xc9\xc3\xcc\xcc\xcc\xcc\xcc\x8b\xffU\x8b\xecV3\xf69u\x0cu\x0e95\x9c\x1a\x03h~-\xff
\x9c\x1a\x03h\x83}\x0c\x01\xa1\xf0\x11\x00h\x8b\x00\xa3\x00 \x03hu=h\x80\x00\x00\x00\xff\x15\xec\x11\x00h;\xc6Y\xa3\x08 \x03hu\x043\xc0\xebg\x890\xa1\x08 \x03hh\x08\xf0\x02hh\x00\xf0\x02h\xa3\x04 \x03h\xe8\xac\x01\x00\x00\xff\x05\x9c\x1a\x03hY\xeb?9u\x0cu;\xa1\x08 \x03h;\xc6t2\xeb\x13\x8b
\x04 \x03h\x8b ; FileHandle => 0x0000026c |
SUCCESS | 0x00000000 | |
| 09:18:05,872 | 1640 | NtReadFile |
Buffer => t3\xc63\xd6%\xfc\xfc\xfc\xfc\x81\xe2\xcf\xcf\xcf\xcf\x8a\xd8\x8a\xcc\xc1\xca\x04\x8b\xab\xb8\x18\x00h\x8a\xda3\xfd\x8b\xa9\xb8\x1a\x00h3\xfd\x8a\xce\xc1\xe8\x10\x8b\xab\xb8\x19\x00h3\xfd\x8a\xdc\xc1\xea\x10\x8b\xa9\xb8\x1b\x00h3\xfd\x8bl$\x1c\x8a\xce%\xff\x00\x00\x00\x81\xe2\xff\x00\x00\x00\x8b\x9b\xb8\x1e\x00h3\xfb\x8b\x99\xb8\x1f\x00h3\xfb\x8b\x98\xb8\x1c\x00h3\xfb\x8b\x9a\xb8\x1d\x00h3\xfb\x8bEx3\xdb\x8bU|3\xc73\xd7%\xfc\xfc\xfc\xfc\x81\xe2\xcf\xcf\xcf\xcf\x8a\xd8\x8a\xcc\xc1\xca\x04\x8b\xab\xb8\x18\x00h\x8a\xda3\xf5\x8b\xa9\xb8\x1a\x00h3\xf5\x8a\xce\xc1\xe8\x10\x8b\xab\xb8\x19\x00h3\xf5\x8a\xdc\xc1\xea\x10\x8b\xa9\xb8\x1b\x00h3\xf5\x8bl$\x1c\x8a\xce%\xff\x00\x00\x00\x81\xe2\xff\x00\x00\x00\x8b\x9b\xb8\x1e\x00h3\xf3\x8b\x99\xb8\x1f\x00h3\xf3\x8b\x98\xb8\x1c\x00h3\xf3\x8b\x9a\xb8\x1d\x00h3\xf3\x8bT$\x14\xd1\xce\x8b\xc73\xfe\x81\xe7\xaa\xaa\xaa\xaa3 FileHandle => 0x0000026c |
SUCCESS | 0x00000000 | |
| 09:18:05,872 | 1640 | NtReadFile |
Buffer => \x83\xf0\xff#\xc2\x03\xcd\x03\xc83\xc0f\xc1\xc1\x02f\x8b\xc1\x8b\xe8\x83\xf0\xff#\xeb#\xc7\x03\xd0\x8bF\x04\x03\xd0\xc1\xe8\x10\x03\xd5\x03\xf83\xc0f\xc1\xc2\x03f\x8b\xc2\x8b\xe8\x83\xf0\xff#\xc3#\xe9\x03\xf8\x03\xfd\x83\xc6\x08f\xc1\xc7\x05\x8b\xc7\xf7\xd0\x8b\xef#\xc1#\xea\x03\xd8\x8b\x06\x03\xdd\x03\xd8\xc1\xe8\x10\x8b\xef\x03\xc83\xc0f\xd1\xc3f\x8b\xc3#\xe8\x83\xf0\xff#\xc2\x03\xcd\x03\xc83\xc0f\xc1\xc1\x02f\x8b\xc1\x8b\xe8\x83\xf0\xff#\xeb#\xc7\x03\xd0\x8bF\x04\x03\xd0\xc1\xe8\x10\x03\xd5\x03\xf83\xc0f\xc1\xc2\x03f\x8b\xc2\x8b\xe8\x83\xf0\xff#\xc3#\xe9\x03\xf8\x03\xfd\x83\xc6\x08f\xc1\xc7\x05\xe9h\x06\x00\x00\x8d\xa4$\x00\x00\x00\x00\x90\x83\xc6xf\xc1\xcf\x05\x8b\xc2\x8b\xea\x83\xf0\xff#\xe9#\xc3f\xc1\xca\x03\x03\xc5+\xf8\x8bF\x04\x8b\xe9+\xd0\xc1\xe8\x10+\xf8\x8b\xc1\xf7\xd5#\xc3#\xef\x03\xe8f\xc1\xc9\x02+\xd5\x8b\xc3\x8b\xef\xf7\xd0#\xeb#\xc2f\xd1\xcb\x03 FileHandle => 0x0000026c |
SUCCESS | 0x00000000 | |
| 09:18:05,872 | 1640 | NtReadFile |
Buffer => h34\x9d\xd81\x00h\x8b]\xf8\xc1\xeb\x08\x0f\xb6\xdb34\x9d\xd8-\x00h\x0f\xb6]\xf434\x9d\xd8)\x00h\x0f\xb6]\xf2\x89p\x08\x0f\xb6u\xf7\x8b4\xb5\xd85\x00h34\x9d\xd81\x00h\x0f\xb6\xd6\x8b\x1c\x95\xd8-\x00h\x0f\xb6U\xf83\xf334\x95\xd8)\x00h\x8bX\x04\x89p\x0c\x8b0\x8bQ\x083\xd6\x8bq\x0c3\xf3\x8bX\x08\x89u\xf0\x8bq\x103\xf3\x8bX\x0c\x89u\xf4\x8bq\x14\x89U\xec3\xf3\x89u\xf8\x8b]\xf4\xc1\xee\x18\x8b4\xb5\xd85\x00h\xc1\xeb\x10\x0f\xb6\xdb34\x9d\xd81\x00h\x8b]\xf0\xc1\xeb\x08\x0f\xb6\xdb34\x9d\xd8-\x00h\x0f\xb6\xda34\x9d\xd8)\x00h\x8b]\xf8\x890\xc1\xeb\x10\x0f\xb6\xdb\x8b\xf2\xc1\xee\x18\x8b4\xb5\xd85\x00h34\x9d\xd81\x00h\x8b]\xf4\xc1\xeb\x08\x0f\xb6\xdb34\x9d\xd8-\x00h\x0f\xb6]\xf034\x9d\xd8)\x00h\x0f\xb6]\xee\x89p\x04\x8bu\xf0\xc1\xee\x18\x8b4\xb5\xd85 FileHandle => 0x0000026c |
SUCCESS | 0x00000000 | |
| 09:18:05,872 | 1640 | NtReadFile |
Buffer => \xc7E\xe8\x02\x00\x00\x00\xeb\x03\x8dI\x00\x8bQ\xf83\x10\x8bq\xfc3p\x04\x89u\xf0\x8b9\x8bp\x083\xf7\x89u\xf4\x8bY\x043X\x0c\x8bu\xf0\x0f\xb6}\xf6\xc1\xee\x18\x8b4\xb5\xd8E\x00h34\xbd\xd8A\x00h\x0f\xb6\xff34\xbd\xd8=\x00h\x0f\xb6\xfa34\xbd\xd89\x00h\x89U\xec\x890\x8bu\xf4\xc1\xee\x18\x8b4\xb5\xd8E\x00h\x89]\xf8\x0f\xb6}\xfa34\xbd\xd8A\x00h\x0f\xb6\xd6\x8b<\x95\xd8=\x00h\x8bU\xf03\xf7\x0f\xb6\xfa34\xbd\xd89\x00h\x0f\xb6}\xee\x89p\x04\x8b\xf3\xc1\xee\x18\x8b4\xb5\xd8E\x00h34\xbd\xd8A\x00h\x0f\xb6\xd6\x8b<\x95\xd8=\x00h\x8bU\xf43\xf7\x0f\xb6\xfa34\xbd\xd89\x00h\x0f\xb6}\xf2\x89p\x08\x0f\xb6u\xef\x8b4\xb5\xd8E\x00h34\xbd\xd8A\x00h\x0f\xb6\xd634\x95\xd8=\x00h\x0f\xb6\xd3\x8b<\x95\xd89\x00h\x8bX\x043\xf7\x8bx\x08\x89p\x0c\x8b0\x8bQ\xe83 FileHandle => 0x0000026c |
SUCCESS | 0x00000000 | |
| 09:18:05,872 | 1640 | NtReadFile |
Buffer => \xc8\x8b\xf1\xc1\xe9\x02\x8d|\x05\xbc3\xc0\xf3\xab\x8b\xce\x83\xe1\x03\xf3\xaa\x8b]\xb4\x8bu\xb8\xb9\x07\x00\x00\x00+\xcb\x8a\\x15\xbc\xb8\x01\x00\x00\x00\xd3\xe0\x8a\xc8\xfe\xc9
\xd8\xf6\xd1"\xcb\x83\xfa7\x88L\x15\xbc[v6\x8dU\xbcRV\xe8\x91a\x00\x003\xc0\x89E\xbc\x89E\xc0\x89E\xc4\x89E\xc8\x89E\xcc\x89E\xd0\x89E\xd4\x89E\xd8\x89E\xdc\x89E\xe0\x89E\xe4\x89E\xe8\x89E\xec\x89E\xf0\x8bN\x10\x8bV\x14\x8dE\xbcPV\x89M\xf4\x89U\xf8\xe8Oa\x00\x00\x8bM\xfc_\xc7F\x18\x01\x00\x00\x003\xc0^\xe8\xc5\xae\xff\xff\x8b\xe5]\xc2\x0c\x00\xcc\xcc\xcc\xcc\xcc\xcc\x8b\xffU\x8b\xec\x8bE\x083\xc9\xc7\x00g\xe6 j\xc7@\x04\x85\xaeg\xbb\xc7@\x08r\xf3n<\xc7@\x0c:\xf5O\xa5\xc7@\x10\x7fR\x0eQ\xc7@\x14\x8ch\x05\x9b\xc7@\x18\xab\xd9\x83\x1f\xc7@\x1c\x19\xcd\xe0[\x89H \x89H$]\xc2\x04\x00\xcc\xcc\xcc\xcc\xcc\x8b\xffU\x8b FileHandle => 0x0000026c |
SUCCESS | 0x00000000 | |
| 09:18:05,872 | 1640 | NtReadFile |
Buffer => \xff\xff\x89}\xd8\x8bx\x1c\x89\x95<\xfc\xff\xff\x89U\xb4\x8bP \x89\xbd@\xfc\xff\xff\x89}\xb8\x8bx$\x89\x95|\xfc\xff\xff\x89U\xdc\x8bP(\x89\xbd\x80\xfc\xff\xff\x89}\xe0\x8bx,\x89\x95L\xfc\xff\xff\x89U\xbc\x8bP0\x89\x8d\x9c\xfc\xff\xff\x89M\xcc\x8bH\x0c\x89\xbdP\xfc\xff\xff\x89}\xc0\x8bx4\x89\x95l\xfc\xff\xff\x89U\xc4\x8bP8\x8b@<\x89\x850\xfc\xff\xff\x89E\xf0\x89\x8d`\xfc\xff\xff\x89\xbdp\xfc\xff\xff\x89}\xc8\x89\x95,\xfc\xff\xff\x89U\xec3\xc0\xeb\x03\x8bu\x0c\x8b\x1e\x8bV\x04\x83\xc6\x08\x89u\x0c3\xf6\x0b\xd63\xff\x0b\xfb\x8b\xda\x89]\x94\x89}\x98\x8b\xf7\x0f\xa4\xdf\x08\x0f\xac\xf2\x08\xc1\xe3\x083\xd3\x8b]\x98\xc1\xee\x083\xf7\x8b}\x94\x0f\xa4\xfb\x08\x81\xe2\xff\x00\xff\x00\xc1\xe7\x083\xd7\x8b\xfa\x89U\x94\x81\xe6\xff\x00\xff\x003\xf3\x8b\xde\x0f\xac\xdf\x10\xc1\xeb\x10\x89u\x98\x0f\xa4\xd6\x103\xde\x8bu\x98\xc1\xe2\x103\xfa\x8bU FileHandle => 0x0000026c |
SUCCESS | 0x00000000 | |
| 09:18:05,872 | 1640 | NtReadFile |
Buffer => \xcc\x89\x8d\x88\xfc\xff\xff\x8b\xce\xf7\xd1#\xcb\x8b]\xd0\xf7\xd2#\xd3\x8b]\xec#\xde\x8bu\xf0#u\xc83\xcb\x8b\x9dp\xfe\xff\xff3\xd63\xbdl\xfe\xff\xff\x8b\xb5\x88\xfc\xff\xff3\xf33\xbd\\xfe\xff\xff3\xb5`\xfe\xff\xff\x8b\x1c\xc5T[\x00h\x03\xcf\x8b\xbc\xc5\xac\xfc\xff\xff\x13\xd6\x03\x0c\xc5P[\x00h\x8b\xb4\xc5\xb0\xfc\xff\xff\x13\xd3\x8b]\xa4\x03\xcf\x8b}\xa8\x13\xd6\x8bu\xbc\x03\xcb\x13\xd7\x03\xf1\x89M\xe4\x8bM\xc0\x13\xca\x89u\xbc\x89U\xe8\x8bU\xd8\x89M\xc0\x8bM\xd4\x8b\xf2\x8b\xf9\x0f\xac\xf7\x1c\x0f\xac\xce\x1c\x89\xb5P\xfe\xff\xff\x8b\xf2\x89\xbdL\xfe\xff\xff\x8b\xfe\x8b\xf1\x89}\xfc\x0f\xac\xf7\x02\x89\xbdt\xfc\xff\xff\x8b\xfa\x0f\xac\xfe\x02\x8b\xbdt\xfc\xff\xff\x89\xb50\xfe\xff\xff\x89\xbd,\xfe\xff\xff\x8b\xf2\x8b\xfa\x8b\xdf\x8b\xf1\x0f\xac\xf3\x07\x0f\xac\xfe\x07\x89\x9d<\xfe\xff\xff\x8b]\xb83\xda#]\xe0\x89\xb5@\xfe\xff\xff\x8bu\xb4\x8b\xfe#\xf13\xf9# FileHandle => 0x0000026c |
SUCCESS | 0x00000000 | |
| 09:18:05,872 | 1640 | NtReadFile |
Buffer => \xbc\x8b\xd6\x8b\xf9\x0f\xac\xd7\x1c\x0f\xac\xca\x1c\x89\x95H\xfe\xff\xff\x89\xbdD\xfe\xff\xff\x8b\xd6\x8b\xfe\x89}\xf8\x8b\xd1\x0f\xac\xd7\x02\x89\xbd\xb4\xfa\xff\xff\x8b\xfe\x0f\xac\xfa\x02\x8b\xbd\xb4\xfa\xff\xff\x89\x95\xb8\xfe\xff\xff\x8b\xd6\x89\xbd\xb4\xfe\xff\xff\x8b\xfa\x8b\xd1\x8b\xdf\x0f\xac\xd3\x07\x0f\xac\xfa\x07\x89\x9d\x04\xfe\xff\xff\x8b]\xc83\xde#]\xf0\x89\x95\x08\xfe\xff\xff\x8bU\xc4\x8b\xfa#\xd13\xf9#}\xec\x8bM\xc83\xfa\x8b\x95\xb4\xfe\xff\xff#\xce3\xd9\x8b\x8d\x04\xfe\xff\xff3\xca3\x8dD\xfe\xff\xff\x8b\x95\x08\xfe\xff\xff3\x95\xb8\xfe\xff\xff3\x95H\xfe\xff\xff\x03\xf9\x13\xda\x8bU\xe4\x8bM\xe8\x03\xfa\x13\xd9\x8bM\xfc\x89]\xe0\x8b]\x0c\x89}\xdc\x8b}\xa0@AC\x89M\xfc\x89]\x0c\x83\xe1\x0f\x8b\x94\xcd\xac\xfc\xff\xff\x8b\x8c\xcd\xb0\xfc\xff\xffG\x8b\xda\x89}\xa0\x8b\xf9\x0f\xac\xfb\x01\x89\x9dT\xfb\xff\xff\x8b\xda\x0f\xac\xdf\x01\x8b\x9dT\xfb\xff\xff\x89\x9d\xc4\xfe\xff\xff\x8b\xda FileHandle => 0x0000026c |
SUCCESS | 0x00000000 | |
| 09:18:05,872 | 1640 | NtReadFile |
Buffer => \xff\x0f\xa4\xd7\x08%\xff\x00\xff\x00\xc1\xe2\x083\xc2\x81\xe1\xff\x00\xff\x003\xcf\x8b\xd0\x89\x85T\xff\xff\xff\x8b\xf9\x0f\xac\xfa\x10\x89\x8dX\xff\xff\xff\x0f\xa4\xc1\x10\xc1\xe0\x103\xd0\x8b\x85T\xff\xff\xff\xc1\xef\x103\xf9\x8b\x8dX\xff\xff\xff\x0f\xa4\xc1\x10\xc1\xe0\x10\x81\xe2\xff\xff\x00\x003\xd0\x8b\x85P\xff\xff\xff\x81\xe7\xff\xff\x00\x003\xf9\xc6\x85l\xff\xff\xff\x80\x89\x94\x05\\xff\xff\xff\x89\xbc\x05`\xff\xff\xff\x8b\xbdh\xff\xff\xff3\xc0\x0b\xf8\x8b\x85d\xff\xff\xff3\xd2\x0b\xd0\x89\x95X\xff\xff\xff\x89\xbdT\xff\xff\xff\x8b\xcf\x8b\xc2\x0f\xac\xc1\x08\x0f\xa4\xfa\x08\xc1\xe8\x08\x89\x85h\xff\xff\xff\x8b\xc1\x8b\x8dh\xff\xff\xff3\xca\x8b\x95T\xff\xff\xff\xc1\xe7\x083\xc7\x8b\xbdX\xff\xff\xff\x0f\xa4\xd7\x08%\xff\x00\xff\x00\xc1\xe2\x083\xc2\x81\xe1\xff\x00\xff\x003\xcf\x8b\xd0\x89\x85T\xff\xff\xff\x8b\xf9\x0f\xac\xfa\x10\x89\x8dX\xff\xff\xff\x0f\xa4\xc1\x10\xc1\xe0\x103\xd0\x8b\x85T\xff\xff\xff FileHandle => 0x0000026c |
SUCCESS | 0x00000000 | |
| 09:18:05,872 | 1640 | NtReadFile |
Buffer => \x00h\x84\xdb\x8b\xd7\x8b\xf1t\x0e\xc1\xe6\x1a\xc1\xe9\x02\xc1\xe2\x1a\xc1\xef\x02\xeb
\xc1\xe6\x1b\xd1\xe9\xc1\xe2\x1b\xd1\xef\x0b\xd7\x0b\xf1\x81\xe6\xff\xff\xff\x0f\x8b\xce\xd1\xe9\x8b\xf9\x81\xe7\x00\x00\x00\x07\x89M\x0c\x8b\xde\x81\xe3\x00\x00\xc0\x00\x0b\xfb\xd1\xef\x8b\xde\x81\xe3\x00\x00\x10\x00\x0b\xfb\xc1\xef\x14\x8b\xd9\x81\xe3\x00\x00\x06\x00\x8b\xce\x81\xe1\x00\xe0\x01\x00\x0b\xd9\x8b\x0c\xbd\xb8#\x00h\xc1\xeb
\x0b\x0c\x9d\xb8"\x00h\x8b}\x0c\x81\xe7\x00\x0f\x00\x00\x81\xe2\xff\xff\xff\x0f\x8b\xde\x81\xe3\xc0\x00\x00\x00\x0b\xfb\xc1\xef\x06\x0b\x0c\xbd\xb8!\x00h\x8b\xfe\x83\xe7?\x0b\x0c\xbd\xb8 \x00h\x8b\xfa\xd1\xef\x89}\xfc\x81\xe7\x00\x00\x00\x06\x8b\xda\x81\xe3\x00\x00\xe0\x01\x0b\xfb\x8b]\xfc\x81\xe3\x00\x1e\x00\x00\x89U\x08\x81\xe2\x80\x01\x00\x00\x0b\xda\xc1\xef\x15\x8b\x14\xbd\xb8'\x00h\xc1\xeb\x07\x0b\x14\x9d\xb8%\x00h\x8b}\x08\x8b\xdf\xc1\xeb\x0f\x83\xe3?\x0b\x14\x9d\xb8&\x00h\x83\xe7?\x0b\x14\xbd\xb8$\x00 FileHandle => 0x0000026c |
SUCCESS | 0x00000000 | |
| 09:18:05,872 | 1640 | NtReadFile |
Buffer => \xec\x8bE\x10\x8b\x08\xf6\xc1\x01u9\x83\xf9 r4\xd1\xe9\x89\x08\x8b\xc1\xc1\xe8\x05@\xf6\xc1\x1ft\x01@\x8d\x0c\x80\x8d\x14\xcd\x14\x00\x00\x00\x8bM\x0c\x89\x11\x8d\x14\xc5\x14\x00\x00\x00\x8bE\x08\x89\x10\xb8\x01\x00\x00\x00]\xc2\x0c\x003\xc0]\xc2\x0c\x00\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\x8b\xffU\x8b\xec\x81\xec\x90\x00\x00\x00S\x8b]\x08\x8b\x03W3\xff=RSA1\x89}\xfct
_3\xc0[\x8b\xe5]\xc2\x0c\x00\x8bC\x08\xd1\xe8V\x8b\xf0\xc1\xee\x05F\xa8\x1ft\x01F\x8bK\x10\xb8\x01\x00\x00\x00;\xc8\x8d\x0c6u\x11\x8bu\x0c\x8b}\x10\xf3\xa5^_[\x8b\xe5]\xc2\x0c\x00\x8dC\x14QP\x89E\xf8\x8bE\x0cP\x89M\x08\xe8#\x08\x00\x00\x85\xc0}b\xc1\xe6\x03\x81\xfe\x88\x00\x00\x00v\x14Vj\x00\xff\x15\x00\x11\x00h\x85\xc0\x89E\xfctG\x8b\xd0\xeb\x06\x8d\x95p\xff\xff\xff3\xc0\x8b\xce\xc1\xe9\x02\x8b\xfa\xf3\xab\x8b\xce\x83 FileHandle => 0x0000026c |
SUCCESS | 0x00000000 | |
| 09:18:05,872 | 1640 | NtReadFile |
Buffer => \xd5\xf8\xff\xff\xff\x89M\x14\xeb\x06\x8bu\xf4\x8bE\x10\x8bM\xcc3\xd2\x8a4\x06\x8aT\x06\xff\x8b\xc2\xc1\xea\x08;\xcau
\xbe\xff\x00\x00\x00\x89u\x1c\xeb 3\xd2\xf7\xf1\x89E\x1c\x8b\xf0\x8b\xc6%\x00\x00\x00\x80\xf7\xd8\x1a\xc0\x8bM\xfc\x8b}\xf8\x89]\xd8\x8d\x0c\x8d\xfc\xff\xff\xff\x8b\xd1\x897%\xff\x00\x00\x00\x0f\xb6\xc0\x8a\xd8\x8bu\xfc\x8a\xfb\xc1\xe9\x02\x83\xc7\x04V\x8b\xc3\xc1\xe0\x10f\x8b\xc3\x8b]\xd8\xf3\xab\x8b\xca\x83\xe1\x03\xf3\xaa\x8bE\xf8\x8bM\xf0PQS\xe8\xfd\xf6\xff\xff\x8b}\xec\x8d\x0c\xb5\x00\x00\x00\x00\x8b\xd1\xc1\xe9\x023\xc0\xf3\xab\x8b\xca\x83\xe1\x03\xf3\xaa\x8bE\x14\x8b}\xec\x8b\xc8\x83\xe1\x1f\xba\x01\x00\x00\x00\xd3\xe2V\xc1\xe8\x05S\x89\x14\x87\x8bE\xf8WP\xe8\xbf\xf6\xff\xff\x8bM\xf8\x8bU\xf4VQRS\xe8T\x04\x00\x00\x8bG\xfc\x85\xc0y)\x8bE\xf0\x8bM\xf8VPWQ\xe8\x9a\xf6\xff\xff\x8bU\xf8VRSS\xe8\xee\x03\x00\x00\x8bM FileHandle => 0x0000026c |
SUCCESS | 0x00000000 | |
| 09:18:05,872 | 1640 | NtReadFile |
Buffer => \x00+\xc1\x83\xd2\x00\x89D\xaf\x0c\x8b\xca\x83\xc5\x04u\x96]\x8b\xc1_^[]\xc2\x10\x00\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\x8b\xffU\x8b\xecSVW\x8bu\x0c\x8b}\x08\x8bM\x103\xdb\x8b\x06\x83\xc6\x04\xf7\xe0\x03\xd8\x8b\x07\x83\xd2\x00\x03\xc3\x8b_\x04\x83\xd2\x00\x89\x07\x03\xd3\xbb\x00\x00\x00\x00\x89W\x04\x83\xd3\x00\x83\xc7\x08Iu\xd5_^[]\xc2\x0c\x00\xcc\xcc\xcc\xcc\xccj\x08hx`\x00h\xe8\x9e1\xff\xff\x83e\xfc\x00\xffu\x08\xff\x15\xb4\x11\x00h\x83M\xfc\xff3\xc0\xeb\x1e\x8bE\xec\x8b\x00\x8b\x003\xc9=\x17\x00\x00\xc0\x0f\x94\xc1\x8b\xc1\xc3\x8be\xe8\x83M\xfc\xffj\x08X\xe8\xa11\xff\xff\xc2\x04\x00\xcc\xcc\xcc\xcc\xcc\x8b\xffU\x8b\xec]\xff%\xb8\x11\x00h\xcc\xcc\xcc\xcc\xcc\x8b\xffU\x8b\xec\x83\xec@VWj\x0eY3\xc0\x8d}\xc0\xf3\xab\x8dE\xfcPj\x013\xf6!u\xfc!u\xf8j\x08\xff\x15\x08\x11\x00hP\xff\x15 FileHandle => 0x0000026c |
SUCCESS | 0x00000000 | |
| 09:18:05,872 | 1640 | NtReadFile |
Buffer => \xff\xff\xff\xd6\x85\xc0t%\x8d\x85\xe4\xfb\xff\xffPSSSSSSSj\x123\xf6FV\x8d\x85\xf4\xfb\xff\xffP\xff\x15D\x10\x00h\x85\xc0u
\xff\x15\xc8\x11\x00h\x8b\xf8\xeb\x1c\x8b\x85\xdc\xfb\xff\xff\xff0\xff\xb5\xe4\xfb\xff\xff\xff\x15P\x10\x00h\x85\xc0t\x02\x8973\xff9\x9d\xe0\xfb\xff\xfft\x0b\xff\xb5\xe0\xfb\xff\xff\xe8I\xf1\xff\xff9\x9d\xe4\xfb\xff\xfft\x0c\xff\xb5\xe4\xfb\xff\xff\xff\x15$\x10\x00h9\x9d\xe8\xfb\xff\xff\x8b5\x04\x11\x00ht\x08\xff\xb5\xe8\xfb\xff\xff\xff\xd69\x9d\xf0\xfb\xff\xfft\x08\xff\xb5\xf0\xfb\xff\xff\xff\xd6\x8bM\xfc\x8b\xc7_^[\xe8\xb8\x1e\xff\xff\xc9\xc2\x04\x00\xcc\xcc\xcc\xcc\xcc\x8b\xffU\x8b\xec\x81\xec \x04\x00\x00\xa1\x84\x18\x03hS\x89E\xfcV3\xdb\x8d\x85\xfc\xfb\xff\xffW\x8b}\x08\x89\x85\xe0\xfb\xff\xff\x8d\x85\xf0\xfb\xff\xffPj\x08\x89\x9d\xf0\xfb\xff\xff\xc7\x85\xec\xfb\xff\xff\x00\x04\x00\x00\x89\x9d\xe4\xfb\xff\xff\x89\x9d\xe8\xfb FileHandle => 0x0000026c |
SUCCESS | 0x00000000 | |
| 09:18:05,872 | 1640 | NtReadFile |
Buffer => \x00\x00\x8d\x85T\xff\xff\xffP\xe9Q\xff\xff\xff\x89\x8dP\xff\xff\xff\xe9\x82\x02\x00\x00W\xff\xb5H\xff\xff\xff\xff\x15,\x11\x00h\x83\xf8\xff\x0f\x84\xfb\xfe\xff\xff\x83\xf8\x1c\x0f\x82c\x02\x00\x00WWWj\x02W\xff\xb5H\xff\xff\xff\xff\x15<\x11\x00h;\xc7\x89\x85<\xff\xff\xff\x0f\x84\xd2\xfe\xff\xffWWWj\x04P\xff\x158\x11\x00h;\xc7\x89\x85L\xff\xff\xff\x0f\x84\xb8\xfe\xff\xff\x8b\x00\x83\xf8\x02\x89\x03\x0f\x85\x1c\x02\x00\x00\x83{ \x00\x8b\x85L\xff\xff\xff\x8dS\x04j\x07\x8dp\x04Y\x8b\xfa\xf3\xa5t\x14\x83:\x00t\x0f\xc7\x85P\xff\xff\xff"\x00 \x80\xe9\xef\x01\x00\x00\x8bH \x8b@$\xffs\x08\x89\x8d4\xff\xff\xff\x89\x858\xff\xff\xff\xe8\xa6\xe0\xff\xff\x85\xc0\x89C@\x0f\x84q\x01\x00\x00\x8bK\x08\x8b\xb5L\xff\xff\xff\x8b\xf8\x8b\xc1\xc1\xe9\x02\x83\xc6(\xf3\xa5\x8b\xc8\x83\xe1\x03\xf3\xa4\x8bs\x08\xffs\x1c\x83\xc6(\x89\xb5P\xff\xff\xff\xe8k\xe0\xff FileHandle => 0x0000026c |
SUCCESS | 0x00000000 | |
| 09:18:05,872 | 1640 | NtReadFile |
Buffer => \x83\xf8\x05\x0f\x85h\x01\x00\x00C\xeb\xc3\xff\xb5\xa8\xfd\xff\xff\xff\x15\xc0\x11\x00h\x83\x8d\xa8\xfd\xff\xff\xff\x83\xa6\x04\x01\x00\x00\x00\x89\x9e\x08\x01\x00\x00i\xdb\x05\x01\x00\x00S\xc7\x86\x00\x01\x00\x00\x05\x01\x00\x00\xe8*\xd1\xff\xff\x85\xc0\x89\x86\x0c\x01\x00\x00u\x08j\x08[\xe9\x1f\x01\x00\x003\xc0PP\xb9\x94\x00\x00\x00\x8d\xbd\xac\xfd\xff\xffP\xf3\xab\x8d\x8d\xac\xfd\xff\xffQP\xff\xb5\x98\xfd\xff\xff\xff\x15$\x11\x00h\x83\xf8\xff\x89\x85\xa8\xfd\xff\xff\x0f\x84\x00\xff\xff\xff\x8b\x1dD\x11\x00h\x8d\x8d\xac\xfd\xff\xffQP\xff\xd3\x85\xc0t"3\xc0\xb9\x94\x00\x00\x00\x8d\xbd\xac\xfd\xff\xff\xf3\xab\x8d\x85\xac\xfd\xff\xffP\xff\xb5\xa8\xfd\xff\xff\xff\xd3\x85\xc0u\x0e\xff\x15\xc8\x11\x00h\x83\xf8\x12\xe9\xc5\xfe\xff\xff\x83\xa5\x9c\xfd\xff\xff\x00\x83\xbe\x08\x01\x00\x00\x00\x8b\xbe\x0c\x01\x00\x00\x0f\x86\x86\x00\x00\x00\x8d\x85\xa0\xfd\xff\xffPW\xff\xb5\xa4\xfd\xff\xff\x8d\x85\xd8\xfd\xff\xffPj\x01\xc7\x85 FileHandle => 0x0000026c |
SUCCESS | 0x00000000 | |
| 09:18:05,872 | 1640 | NtReadFile |
Buffer => W\xe8\x13\xfc\xff\xff\x85\xc0u:\x8dE\xfcP\x8dE\xf8PVh\xe4\x1a\x03hha\x1d\x00\x00W\xe8\xf6\xfb\xff\xff\x85\xc0u\x1d\x8dE\xfcP\x8dE\xf8PVh\x04\x1b\x03hhb\x1d\x00\x00W\xe8\xd9\xfb\xff\xff\x85\xc0t*\x8b\xf0\xa1\xa8\x1a\x03h\x85\xc0t
P\xe8Z\xc1\xff\xff\x83%\xa8\x1a\x03h\x00\x85\xfft\x07W\xff\x15\xa4\x11\x00h\x8b\xc6\xe9\x92\x00\x00\x00\xa1\xa8\x1a\x03h\x01\x05\xbc\x1a\x03h\x01\x05\xc0\x1a\x03h\x01\x05\xc4\x1a\x03h\x01\x05\xb0\x1a\x03h\x01\x05\xb4\x1a\x03h\x01\x05\xb8\x1a\x03h\x01\x05\xd4\x1a\x03h\x01\x05\xd8\x1a\x03h\x01\x05\xc8\x1a\x03h\x01\x05\xcc\x1a\x03h\x01\x05\xd0\x1a\x03h\x01\x05\xe0\x1a\x03h\x01\x05\xf4\x1a\x03h\x01\x05\xfc\x1a\x03h\x01\x05\xf8\x1a\x03h\x01\x05\x00\x1b\x03h\x01\x05\xdc\x1a\x03h\x01\x05\xf0\x1a\x03h\x01\x05\xec\x1a\x03h\x01\x05\xe8\x1a\x03h\x01\x05\xe4\x1a\x03h\x01\x05\x04\x1b\x03hW\xff\x15\xa4\x11\x00h3\xc0 FileHandle => 0x0000026c |
SUCCESS | 0x00000000 | |
| 09:18:05,872 | 1640 | NtReadFile |
Buffer => \x11\x00h3\xff\xe9\x88\x00\x00\x003\xc0\x8dM\xfc@QPS\x89E\xf4\xff\xd6P\xff\xd7\x85\xc0t]3\xc0\x8d}\xd8\xab\xab\xab\xab3\xc0\x8d}\xc8\xab\xab\xab\xab\x8dE\xe8Ph c\x00hj\x00\xff\x15p\x10\x00h\x85\xc0t6\x8bE\xe8\x89E\xdc\x8bE\xec\x89E\xe0\x8dE\xf0P\x8dE\xc8Pj\x10\x8dE\xd8Pj\x00\xffu\xfc\xc7E\xd8\x01\x00\x00\x00\xc7E\xe4\x02\x00\x00\x00\xff\x15\x80\x10\x00h\x89E\xf83\xff\xffu\x1c\xffu\x18\xffu\x14\xffu\x10\xffu\x0c\xe8\xc3\xe6\xff\xff9}\x08\x8b\xf0t\x179}\xf8t\x12WWj\x10\x8dE\xc8PW\xffu\xfc\xff\x15\x80\x10\x00h9}\xfct \xffu\xfc\xff\x15\x04\x11\x00h9}\xf4t\x06\xff\x15X\x10\x00h_\x8b\xc6^[\xc9\xc2\x18\x00\xcc\xcc\xcc\xcc\xcc\x8b\xffU\x8b\xecQV\x8b5\x08\x1b\x03hWV\x89u\xfc\xe8\x88\xaf\xff\xff\x8b\xf8\x85\xff\x0f\x85\x02\x01\x00\x009F \x0f\x84\xf1\x00\x00 FileHandle => 0x0000026c |
SUCCESS | 0x00000000 | |
| 09:18:05,872 | 1640 | NtReadFile |
Buffer => \xc0\x0f\x84\xd2\xfc\xff\xff3\xf6F\x83}\xb4\x00\x0f\x85\xfd\x01\x00\x00\x8bM\xb0\x8dA\x019E\xd4\x0f\x84\xee\x01\x00\x009M\xd4\xffu\x10\x0f\x85\xd8\x01\x00\x00\x8dE\xb8P\xffu\xe4\xffu\x0c\xffu\x08\xe8]-\x00\x00\x8b\xf0\x85\xf6\x0f\x84\xe3\x01\x00\x00\x83}\xb8\x01uj\xffu\x10\x8dE\xbcP\x8bE\xcc\xff0\xffu\x0c\xffu\x08\xffu\xc8\xffs \xe8\x07\xf9\xff\xff\x8b\xf0\x85\xf6\x0f\x84\xb6\x01\x00\x00\x83}\xbc\x00u=\xffu\x10\xffu\x0c\xffwT\xffu\x08\xe8G+\x00\x00\x85\xc0\x0f\x84B\xfc\xff\xff\xffu\x10\x8dE\xacPj\x01j\x08\xffwT\xffu\x0c\xffu\x08\xe8&7\x00\x00\x85\xc0\x0f\x84!\xfc\xff\xff3\xf6F\x83}\xac\x00\x0f\x84\xe8\xfe\xff\xff\xffE\xfc\x83E\xd0\x04\x83E\xdc\x08\x83E\xcc\x04\x83}\xfc\x01\x0f\x86\x18\xfc\xff\xff\x83e\xfc\x00\x8dG<\x89E\x08\x8dC0\x89E\xcc\x8dC8\x89E\xd0\xffu\x10\x8bE\x08\xffu\xd0j\x01\xff FileHandle => 0x0000026c |
SUCCESS | 0x00000000 | |
| 09:18:05,872 | 1640 | NtReadFile |
Buffer => \xd0\x8b\xd9\x83\xe0\x1f\xc1\xea\x05\xc1\xee\x05;\xc3\x89]\xfcr\x1b\x8dK\x01;\xf9\x89M\x18w\x03\x89}\x18\x8b\xc8\x8bE\x08\x8b\x14\x90+\xcb\xd3\xea\xeb\x19\x8dH\x01;\xf9\x89M\x18w\x03\x89}\x18\x8b\xcb+\xc8\x8bE\x08\x8b\x14\x90\xd3\xe2j Y+M\x18\x83\xc8\xff\xd3\xe0j\x1fY+M\xfc\xd3\xe8\x8bM\x10\x8d\x0c\xb1\x8b\xf0\xf7\xd6#1#\xc2\x0b\xf0+}\x18\x891\x0f\x85w\xff\xff\xff^[3\xc0@_\xc9\xc2\x18\x00\xcc\xcc\xcc\xcc\xcc\x8b\xffU\x8b\xecVW\xffu\x0c\x8b}\x08W\xe8\xbe\xfd\xff\xff\x8b\xf0\x85\xf6t\x0f\xfft\xb7\xfc\xe8Z\xfe\xff\xffN\xc1\xe6\x05\x03\xc6_^]\xc2\x0c\x00\xcc\xcc\xcc\xcc\xcc\x8b\xffU\x8b\xecV3\xc93\xf69M\x0ct\x0e\x8bE\x089\x0c\xb0u\x18F;u\x0cu\xf5\xffu\x10Qj\x11\xe8\\xb7\xfe\xff3\xc0^]\xc2\x0c\x00\xff4\xb0\xe8M\xfe\xff\xff\xc1\xe6\x05\x03\xc6\xeb\xec\xcc\xcc\xcc\xcc\xcc\x8b\xffU\x8b\xecQ FileHandle => 0x0000026c |
SUCCESS | 0x00000000 | |
| 09:18:05,872 | 1640 | NtReadFile |
Buffer => \xfc\x839\x00u\x08N\x83\xe9\x04\x85\xf6u\xf3\x8dD\x18\xfc\x838\x00u\x08J\x83\xe8\x04\x85\xd2u\xf3\xffu0\x8b]\xe4\x8dE\x80P\xffu,\x89u\xe8\x8bu\xe0SV\x8dE\x90P\x89U\xec\xe8\x89'\x00\x00\x85\xc0\x0f\x84 \x01\x00\x00\x8bM\x803\xffG\x85\xc9u 9M\x84\x0f\x84\x00\xfc\xff\xff\x8bE,;E\x14\x0f\x83\xf1\x00\x00\x00\x89\x0c\x86\x8bE,\x8bM\x84\x89\x0c\x83\xe94\xfe\xff\xff\x8b}\xf4\x8bU\xb4\xc1\xe7\x02\xc1\xe2\x02\x8bD\x15\xe8\x8bL\x15\xe0\x8dt=\xe8\x8b\x1e+\xd8\x89E\xfc\x8bE,C\x89M\xb4\xe8\xcb\xf6\xff\xff\xffu0\x89E\xf8\xffu\xd4\x8bD=\xd8\xffu\xd0j\x00\xffu\xfc\xfft\x15\xd8\xff6P\xe8\xa1\x11\x00\x00\x85\xc0\x0f\x84\x85\x00\x00\x00\x8bM\xd0\x8b\xc3\xe8\x98\xf6\xff\xff\x8bM\xd4\x8b\xd8\x8bE\xfc\xe8\x8b\xf6\xff\xff\x89\x06\xc1\xe0\x02P\xffu\xd4\xfft=\xd8\xe8\xe1<\x00\x00\x83\xc4\x0c\xffu0\xffu\xd4\xffu FileHandle => 0x0000026c |
SUCCESS | 0x00000000 | |
| 09:18:05,872 | 1640 | NtReadFile |
Buffer => \x01\x00\x00\x8dt\x9e\xfc\x8b\x06;\xc1\x89u\xe8\x0f\x84\xff\x00\x00\x00P\x89M\xfc\x89M\xec\xe8\xe0\xde\xff\xff\x8b>j Y+\xc8\x83\xfb\x02\x89M\xf8r \x8bE\x08\x8bt\x98\xf8\xeb\x023\xf6\x83\xfb\x03r \x8bE\x08\x8bT\x98\xf4\xeb\x023\xd2j\x1f[\xffu\x14+\xd9\x83e\xf4\x00\x8b\xc6\xd1\xe8\x8b\xcb\xd3\xe8\x8bM\xf8\xd3\xe7\xd1\xea\x8b\xcb\xd3\xea\x8bM\xf8\xd3\xe6\x0b\xc7\x8d}\xecW\x0b\xd6\x8b\xf2\x83\xcb\xff\x8d}\xfcW\x8b\xd3P+\xd0\x8b\xcb+\xceRQ\xe8\xa8\xfe\xff\xff\x85\xc0t9\x8bE\xfc\xf7\xe6;U\xec\xc7E\xf4\x01\x00\x00\x00\x89E\xe0v\x03\xffM\xfc\x8bM\xf8\x8bE\xe8\x8b}\x0c\x8b\xf3\xd3\xee+0O;u\xfcsD\x85\xffv\x0f\x8bE\x08\x8bD\xb8\xfc\xeb\x08\x83e\xf4\x00\xebW3\xc0\x8bU\x08\x83e\xe4\x00\x8b\xcb+\xc8\x8bE\xfc\xf7$\xba;\xd6w\x17r\x04;\xc1w\x11+\xc8\x1b\xf2\x89u\xe4\x8b\xf1u \x85\xffu\xbb\xeb\x03 FileHandle => 0x0000026c |
SUCCESS | 0x00000000 | |
| 09:18:05,872 | 1640 | NtReadFile |
Buffer => \xfb\xcb\x0f\xd4\xc1\x0f\x7f\xc1\x0f\x7f\xd3\x0f\xdb\xcb\x0f\x7f \x83\xc1\x10O\x0fs\xd0 \x0f\x7f\xc1u\xd19S\x0c\x0f\xef\xc0\x0f\x7f\xc3\x0f\xfb\xd9\x0f\x7f\xd9\x0f\xdf\xcat.\x8bK\x08+\xf1\x0fo\x14\x0e\x0f\xd4\xc2\x0fo\x11\x0f\x7f\xcb\x0f\xdb\xd3\x0f\xd4\xc2\x0f\x7f\xc2\x0f~\xd7\x89<\x90B\x83\xc1\x10;S\x0c\x0fs\xd0 u\xd7\x0fw3\xc0_@^\x8b\xe5]\x8b\xe3[\xc2\x0c\x00\xcc\xcc\xcc\xcc\xcc\x8b\xffS\x8b\xdcQQ\x83\xe4\xf0\x83\xc4\x04U\x8bk\x04\x89l$\x04\x8b\xec\x83\xec8\x8bC\x10\x8bK\x18\x83e\xec\x00\x83M\xe8\xff\x83e\xe4\x00\x83M\xe0\xfff\x0foU\xe0\x89E\xd0\x8bC\x14V\x8b0W\x8bx \x8b@\x1c\x89E\xdc\x8bC\x08\x8b\x10\x0f\xafU\xdc\x83\xc1\x0f\x8b\xc6\x83\xe1\xf0\xc1\xe0\x04\x03\xc1\x85\xf6\x89U\xc8\x89E\xd4tY\x8bS\x08+\xd7\x89E\xf8)M\xf8f\x0f\xef\xc0\x89M\xd8\x89}\xfc\x89U\xcc\x89u\xf4\xeb\x03\x8bU\xcc\x8b}\xfc FileHandle => 0x0000026c |
SUCCESS | 0x00000000 | |
| 09:18:05,872 | 1640 | NtReadFile |
Buffer => \xff\x85\xf6t\x08\x8b\xc8\x8b\xc2\x8b\xd1\x8b\xce\x83e\x14\x00\x85\xd2_u\x0f\x8bU\x18\x8bu\xfc\x89\x02\x89J\x04\xebh\xd1\xea\x8b\xda\xf7\xd3\xf6\xc3\x01u\xf5\xeb1;\xc2\x1b\xf6\xf7\xde+\xce+\xc2\xeb
\x8b\xf1\xc1\xe6\x1e\xc1\xe8\x02\x0b\xc6\xc1\xe9\x02\xa8\x03t\xef\x8b\xd8\xf7\xd3\xf6\xc3\x01t\x0b\x8b\xf1\xc1\xe6\x1f\xd1\xe8\x0b\xc6\xd1\xe9\x85\xc9u\xcb\xffu\x1c\x8dM\x14QRP\xe8
\xfe\xff\xff3\xf6\x85\xc0t\x12\x8bE\x14\x83e\x14\x00\x8bM\x18F3\xd2\x89\x01\x89Q\x04\x8b\xc6^[\xc9\xc2\x18\x00\xcc\xcc\xcc\xcc\xcc\x8b\xffU\x8b\xec\x83\xec\x10SVW\xffu\x1c\xffu\x10\xffu\x0c\xe8\xd3\xbf\xff\xff\x8bu\x18\x8b\x1e\xffu\x1c\x8bN\x08\x89E\xf8\x8b\xc3\xc1\xe0\x02j\x00\x03\xc8Q\x89E\xf0\xe8 \xc6\xff\xff\x8b\xf8\x85\xff\x89}\xfcu\x073\xdb\xe9\xbc\x01\x00\x00\x83}\xf8\x00\xffu\x1c\xff6u\x1d\xffv \x8bF,\xffu\x14PP\xe8\xf8\xb3\xff\xff\x8b\xd8\xf7\xdb FileHandle => 0x0000026c |
SUCCESS | 0x00000000 | |
| 09:18:05,872 | 1640 | NtReadFile |
Buffer => Data\x002\x00\x00CryptUnprotectData\x00d\x00\x00SHGetFolderPathW\x002\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1c\xe0\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\xc0\xe0\x02\x00\xe0\x11\x00\x00\x10\xdf\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00N\xe3\x02\x00\xd4\x10\x00\x00<\xde\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00j\xe4\x02\x00\x00\x10\x00\x00T\xe0\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x14\xe7\x02\x00\x18\x12\x00\x00\x0c\xe0\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00D\xe7\x02\x00\xd0\x11\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x14\xea\x02\x00\x00\xea\x02\x00\xe0\xe9\x02\x00\xc2\xe9\x02\x00\xa6\xe9\x02\x00\x8a\xe9\x02\x00 FileHandle => 0x0000026c |
SUCCESS | 0x00000000 | |
| 09:18:05,872 | 1640 | NtReadFile |
Buffer => \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00FL\x01h\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00J\xdd\xa2,y\xe8!\x05\xd4\x13\x00h\xc0\x13\x00h\xbc\x13\x00h\xa8\x13\x00h\x94\x13\x00h\xbc\x13\x00h\x80\x13\x00hl\x13\x00h\xbc\x13\x00hX\x13\x00hH\x13\x00h FileHandle => 0x0000026c |
SUCCESS | 0x00000000 | |
| 09:18:05,872 | 1640 | NtReadFile |
Buffer => m (SHA-1)\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x80\x00\x00\x80\x00\x00\x00\x80\x00\x00\x00\x80\x00\x00\x00 \x00\x00\x00\x04\x00\x00\x00MD2\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x17\x00\x00\x00Message Digest 2 (MD2)\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x80\x00\x00\x80\x00\x00\x00\x80\x00\x00\x00\x80\x00\x00\x00 \x00\x00\x00\x04\x00\x00\x00MD4\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x17\x00\x00\x00Message Digest 4 (MD4)\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x80\x00\x00\x80\x00\x00\x00\x80\x00\x00\x00\x80\x00\x00\x00 \x00\x00\x00\x04\x00\x00\x00MD5\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x17\x00\x00\x00Message Dige FileHandle => 0x0000026c |
SUCCESS | 0x00000000 | |
| 09:18:05,872 | 1640 | NtReadFile |
Buffer => \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x18\x00\x00\x00RSA Data Security's RC4\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01f\x00\x008\x00\x00\x008\x00\x00\x008\x00\x00\x00\x0f\x00\x00\x00\x04\x00\x00\x00DES\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00Data Encryption Standard (DES)\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 f\x00\x00p\x00\x00\x00p\x00\x00\x00p\x00\x00\x00\x0f\x00\x00\x00
\x00\x00\x003DES TWO KEY\x00\x00\x00\x00\x00\x00\x00\x00\x13\x00\x00\x00Two Key Triple DES\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03f\x00\x00\xa8\x00\x00\x00\xa8\x00\x00\x00\xa8\x00\x00\x00\x0f\x00\x00\x00 FileHandle => 0x0000026c |
SUCCESS | 0x00000000 | |
| 09:18:05,872 | 1640 | NtQueryInformationFile |
FileHandle => 0x0000026c FileInformation => \xd0\x10\x03\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:18:05,872 | 1640 | NtSetInformationFile |
FileHandle => 0x0000026c FileInformation => |
SUCCESS | 0x00000000 | |
| 09:18:05,872 | 1640 | NtReadFile |
Buffer => \x00\x01\x00\x00P\x01\x00\x00\x1c\x86V\xe4\x80\xb9\x0fs\x00\x007\x00C\x00A\x00P\x00I\x00:\x00 \x00T\x00h\x00e\x00 \x00i\x00n\x00s\x00t\x00a\x00l\x00l\x00 \x00p\x00r\x00o\x00g\x00r\x00a\x00m\x00 \x00c\x00o\x00u\x00l\x00d\x00 \x00n\x00o\x00t\x00 \x00o\x00p\x00e\x00n\x00 \x00s\x00i\x00g\x00n\x00a\x00t\x00u\x00r\x00e\x00 \x00f\x00i\x00l\x00e\x00?\x00C\x00A\x00P\x00I\x00:\x00 \x00T\x00h\x00e\x00 \x00i\x00n\x00s\x00t\x00a\x00l\x00l\x00 \x00p\x00r\x00o\x00g\x00r\x00a\x00m\x00 \x00c\x00o\x00u\x00l\x00d\x00 \x00n\x00o\x00t\x00 \x00g\x00e\x00t\x00 \x00t\x00h\x00e\x00 \x00s\x00i\x00z\x00e\x00 \x00o\x00f\x00 \x00R\x00s\x00a\x00b\x00a\x00s\x00e\x00.\x00s\x00i\x00 FileHandle => 0x0000026c |
SUCCESS | 0x00000000 | |
| 09:18:05,872 | 1640 | NtReadFile |
Buffer => \x07:\x0e:\x18:%:t:\x81:\x8f:\x9f:\xad:\xbb:\xc9:\xda:\xe8:\xf6:\x04;\x12; ;2;C;Q;\xa0;\xdb;\xe5;\xef;\xf9;\x10<\x17<'<4<M<T<a<l<~<\x85<\x8f<\x99<\xda<\xe7<\xf7<\x01=\x18=\x1f=/=:=Q=X=h=s=\x85=\x8c=\x96=\xa3=\xde=\xeb=\xfb=\x05>\x1c>#>3>>>R>Y>i>t>\x86>\x8d>\x97>\xa4>\xdf>\xe9>\xf9>\x03?\x17?$?4???S?Z?j?u?\x87?\x8e?\x98?\xa3?\xdc?\xe6?\xf6?\x00\x80\x01\x00\xe4\x01\x00\x00\x000\x170\x1e0.090L0W0g0r0\x840\x8b0\x950\xa20\xee0\xfa0\x081\x1e1(181F1W1d1t1\x821\x901\xa21\xaf1\xbd1\xcb102k2u2\x7f2\x892\xa02\xa72 FileHandle => 0x0000026c |
SUCCESS | 0x00000000 | |
| 09:18:05,922 | 1640 | LdrLoadDll |
Flags => 33291232 BaseAddress => 0x68000000 FileName => rsaenh.dll |
SUCCESS | 0x00000000 | |
| 09:18:05,922 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPAcquireContext FunctionAddress => 0x6800fb46 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:18:05,922 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPReleaseContext FunctionAddress => 0x6800f017 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:18:05,922 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPGenKey FunctionAddress => 0x6800afb1 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:18:05,922 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPDeriveKey FunctionAddress => 0x6800d086 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:18:05,922 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPDestroyKey FunctionAddress => 0x68009460 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:18:05,922 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPSetKeyParam FunctionAddress => 0x68009638 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:18:05,922 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPGetKeyParam FunctionAddress => 0x68009a22 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:18:05,932 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPExportKey FunctionAddress => 0x6800ba24 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:18:05,932 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPImportKey FunctionAddress => 0x6800bf8a ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:18:05,932 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPEncrypt FunctionAddress => 0x68006c8e ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:18:05,932 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPDecrypt FunctionAddress => 0x68007100 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:18:05,932 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPCreateHash FunctionAddress => 0x680074ba ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:18:05,932 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPHashData FunctionAddress => 0x68007e56 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:18:05,932 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPHashSessionKey FunctionAddress => 0x68007fa0 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:18:05,932 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPDestroyHash FunctionAddress => 0x680082d1 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:18:05,932 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPSignHash FunctionAddress => 0x6800da22 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:18:05,932 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPVerifySignature FunctionAddress => 0x6800df0a ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:18:05,932 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPGenRandom FunctionAddress => 0x6800d7a7 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:18:05,932 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPGetUserKey FunctionAddress => 0x68009562 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:18:05,932 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPSetProvParam FunctionAddress => 0x68009e6d ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:18:05,932 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPGetProvParam FunctionAddress => 0x68009f9c ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:18:05,932 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPSetHashParam FunctionAddress => 0x6800a56f ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:18:05,932 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPGetHashParam FunctionAddress => 0x6800c891 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:18:05,932 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPDuplicateKey FunctionAddress => 0x6800aaae ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:18:05,932 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPDuplicateHash FunctionAddress => 0x6800852e ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:18:05,932 | 1640 | RegOpenKeyExA |
Handle => 0x0000026c Registry => 0x80000002 SubKey => Software\Microsoft\Cryptography |
SUCCESS | 0x00000000 | |
| 09:18:05,932 | 1640 | RegQueryValueExA |
Handle => 0x0000026c DataLength => 37 ValueName => MachineGuid Type => 1 |
SUCCESS | 0x00000000 | |
| 09:18:05,932 | 1640 | RegQueryValueExA |
Handle => 0x0000026c Data => 99d6ed61-80b2-42d4-8c72-45c08cbdb8ae\x00 ValueName => MachineGuid |
SUCCESS | 0x00000000 | |
| 09:18:05,932 | 1640 | RegCloseKey |
Handle => 0x0000026c |
SUCCESS | 0x00000000 | |
| 09:18:05,932 | 1640 | LdrLoadDll |
Flags => 33291008 BaseAddress => 0x77fe0000 FileName => Secur32.dll |
SUCCESS | 0x00000000 | |
| 09:18:05,932 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetUserNameExA FunctionAddress => 0x77fe1dca ModuleHandle => 0x77fe0000 |
SUCCESS | 0x00000000 | |
| 09:18:05,932 | 1640 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Microsoft\Cryptography\Offload |
FAILURE | 0x00000002 | |
| 09:18:05,932 | 1640 | RegCloseKey |
Handle => 0x00000268 |
SUCCESS | 0x00000000 | |
| 09:18:05,952 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => NtCreateEvent FunctionAddress => 0x7c90d070 ModuleHandle => 0x7c900000 |
SUCCESS | 0x00000000 | |
| 09:18:05,962 | 1640 | LdrLoadDll |
Flags => 33291280 BaseAddress => 0x77a80000 FileName => CRYPT32.dll |
SUCCESS | 0x00000000 | |
| 09:18:05,962 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CryptProtectData FunctionAddress => 0x77a8b942 ModuleHandle => 0x77a80000 |
SUCCESS | 0x00000000 | |
| 09:18:05,962 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00237da8 | |
| 09:18:05,962 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000027c |
SUCCESS | 0x00000000 | |
| 09:18:05,962 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000278 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:05,962 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00237da8 | |
| 09:18:05,982 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00237da8 | |
| 09:18:05,982 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000027c |
SUCCESS | 0x00000000 | |
| 09:18:05,982 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000278 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:05,982 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00237da8 | |
| 09:18:05,982 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00237da8 | |
| 09:18:05,982 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00237da8 | |
| 09:18:05,982 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000027c |
SUCCESS | 0x00000000 | |
| 09:18:05,982 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000278 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:05,982 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00237da8 | |
| 09:18:05,982 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00237da8 | |
| 09:18:05,982 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00237da8 | |
| 09:18:05,982 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00237da8 | |
| 09:18:05,982 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000027c |
SUCCESS | 0x00000000 | |
| 09:18:05,982 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000278 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:05,982 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00237da8 | |
| 09:18:05,992 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00237da8 | |
| 09:18:05,992 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00237da8 | |
| 09:18:05,992 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00237da8 | |
| 09:18:06,032 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\Security DesiredAccess => 0x00100001 CreateDisposition => 2 FileHandle => 0x0000027c |
SUCCESS | 0x00000000 | |
| 09:18:06,032 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000278 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:06,062 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00237da8 | |
| 09:18:06,062 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00237da8 | |
| 09:18:06,062 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00237da8 | |
| 09:18:06,062 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00237da8 | |
| 09:18:06,062 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000027c |
SUCCESS | 0x00000000 | |
| 09:18:06,062 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000278 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:06,062 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00237da8 | |
| 09:18:06,062 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00237da8 | |
| 09:18:06,062 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00237da8 | |
| 09:18:06,062 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00237da8 | |
| 09:18:06,072 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000027c |
SUCCESS | 0x00000000 | |
| 09:18:06,072 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000278 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:06,072 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00237da8 | |
| 09:18:06,072 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00237da8 | |
| 09:18:06,072 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00237da8 | |
| 09:18:06,072 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00237da8 | |
| 09:18:06,072 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000027c |
SUCCESS | 0x00000000 | |
| 09:18:06,072 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000278 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:06,072 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00237da8 | |
| 09:18:06,072 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00237da8 | |
| 09:18:06,072 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00237da8 | |
| 09:18:06,072 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00237da8 | |
| 09:18:06,072 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000027c |
SUCCESS | 0x00000000 | |
| 09:18:06,072 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000278 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:06,072 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00237da8 | |
| 09:18:06,072 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00237da8 | |
| 09:18:06,082 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00237da8 | |
| 09:18:06,082 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00237da8 | |
| 09:18:06,082 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\Security |
SUCCESS | 0x00237da8 | |
| 09:18:06,082 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\Security\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000027c |
SUCCESS | 0x00000000 | |
| 09:18:06,082 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000278 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:06,082 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00237da8 | |
| 09:18:06,082 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00237da8 | |
| 09:18:06,082 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00237da8 | |
| 09:18:06,082 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00237da8 | |
| 09:18:06,082 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\Security |
SUCCESS | 0x00237da8 | |
| 09:18:06,082 | 1640 | NtCreateFile |
ShareAccess => 0 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\Security\services_rdrk.dat DesiredAccess => 0x0012019f CreateDisposition => 5 FileHandle => 0x0000027c |
SUCCESS | 0x00000000 | |
| 09:18:06,082 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000278 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:06,082 | 1640 | NtQueryInformationFile |
FileHandle => 0x0000027c FileInformation => \x90\xa7\x11\xb6\x8a\xa2\xcf\x01\x90\xa7\x11\xb6\x8a\xa2\xcf\x01\x90\xa7\x11\xb6\x8a\xa2\xcf\x01\x90\xa7\x11\xb6\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00=L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xb4\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:06,082 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00237da8 | |
| 09:18:06,092 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00237da8 | |
| 09:18:06,092 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00237da8 | |
| 09:18:06,092 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00237da8 | |
| 09:18:06,092 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000027c |
SUCCESS | 0x00000000 | |
| 09:18:06,092 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000278 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:06,092 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00237da8 | |
| 09:18:06,092 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00237da8 | |
| 09:18:06,092 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00237da8 | |
| 09:18:06,092 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00237da8 | |
| 09:18:06,092 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000027c |
SUCCESS | 0x00000000 | |
| 09:18:06,092 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000278 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:06,092 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00237da8 | |
| 09:18:06,092 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00237da8 | |
| 09:18:06,092 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00237da8 | |
| 09:18:06,092 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00237da8 | |
| 09:18:06,092 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\Security |
SUCCESS | 0x00237da8 | |
| 09:18:06,092 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\Security\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000027c |
SUCCESS | 0x00000000 | |
| 09:18:06,092 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000278 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:06,102 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00237da8 | |
| 09:18:06,102 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00237da8 | |
| 09:18:06,102 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00237da8 | |
| 09:18:06,102 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00237da8 | |
| 09:18:06,102 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\Security |
SUCCESS | 0x00237da8 | |
| 09:18:06,102 | 1640 | NtCreateFile |
ShareAccess => 0 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\Security\services_rdr.dat DesiredAccess => 0x0012019f CreateDisposition => 5 FileHandle => 0x0000027c |
SUCCESS | 0x00000000 | |
| 09:18:06,102 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000278 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:06,102 | 1640 | NtQueryInformationFile |
FileHandle => 0x0000027c FileInformation => \xf0\xb5\x14\xb6\x8a\xa2\xcf\x01\xf0\xb5\x14\xb6\x8a\xa2\xcf\x01\xf0\xb5\x14\xb6\x8a\xa2\xcf\x01\xf0\xb5\x14\xb6\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00>L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xb2\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:06,102 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00237da8 | |
| 09:18:06,102 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00237da8 | |
| 09:18:06,102 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00237da8 | |
| 09:18:06,102 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00237da8 | |
| 09:18:06,102 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000027c |
SUCCESS | 0x00000000 | |
| 09:18:06,102 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000278 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:06,102 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00237da8 | |
| 09:18:06,102 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00237da8 | |
| 09:18:06,102 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00237da8 | |
| 09:18:06,112 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00237da8 | |
| 09:18:06,112 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000027c |
SUCCESS | 0x00000000 | |
| 09:18:06,112 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000278 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:06,112 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00237da8 | |
| 09:18:06,112 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00237da8 | |
| 09:18:06,112 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00237da8 | |
| 09:18:06,112 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00237da8 | |
| 09:18:06,112 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\Security |
SUCCESS | 0x00237da8 | |
| 09:18:06,112 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\Security\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000027c |
SUCCESS | 0x00000000 | |
| 09:18:06,112 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000278 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:06,112 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00237da8 | |
| 09:18:06,112 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00237da8 | |
| 09:18:06,112 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00237da8 | |
| 09:18:06,112 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00237da8 | |
| 09:18:06,112 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\Security |
SUCCESS | 0x00237da8 | |
| 09:18:06,133 | 1640 | NtCreateFile |
ShareAccess => 0 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\Security\services_rdri.dat DesiredAccess => 0x0012019f CreateDisposition => 5 FileHandle => 0x0000027c |
SUCCESS | 0x00000000 | |
| 09:18:06,133 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000278 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:06,143 | 1640 | NtQueryInformationFile |
FileHandle => 0x0000027c FileInformation => =\x16\xb6\x8a\xa2\xcf\x01 =\x16\xb6\x8a\xa2\xcf\x01 =\x16\xb6\x8a\xa2\xcf\x01 =\x16\xb6\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00?L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xb4\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:06,143 | 1640 | NtOpenKey |
DesiredAccess => 131097 KeyHandle => 0x0000027c ObjectAttributes => \REGISTRY\USER\S-1-5-21-1935655697-1606980848-1060284298-1003 |
SUCCESS | 0x00000000 | |
| 09:18:06,143 | 1640 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x0000027c SubKey => SOFTWARE\Microsoft\Cryptography\Providers\Type 001 |
FAILURE | 0x00000002 | |
| 09:18:06,143 | 1640 | RegOpenKeyExA |
Handle => 0x0000027c Registry => 0x80000002 SubKey => SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types\Type 001 |
SUCCESS | 0x00000000 | |
| 09:18:06,143 | 1640 | RegQueryValueExA |
Handle => 0x0000027c DataLength => 40 ValueName => Name Type => 1 |
SUCCESS | 0x00000000 | |
| 09:18:06,143 | 1640 | RegQueryValueExA |
Handle => 0x0000027c Data => Microsoft Strong Cryptographic Provider\x00 ValueName => Name |
SUCCESS | 0x00000000 | |
| 09:18:06,143 | 1640 | RegCloseKey |
Handle => 0x0000027c |
SUCCESS | 0x00000000 | |
| 09:18:06,143 | 1640 | RegOpenKeyExA |
Handle => 0x0000027c Registry => 0x80000002 SubKey => SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Strong Cryptographic Provider |
SUCCESS | 0x00000000 | |
| 09:18:06,143 | 1640 | RegQueryValueExA |
Handle => 0x0000027c Data => 1 ValueName => Type |
SUCCESS | 0x00000000 | |
| 09:18:06,143 | 1640 | RegQueryValueExA |
Handle => 0x0000027c DataLength => 11 ValueName => Image Path Type => 1 |
SUCCESS | 0x00000000 | |
| 09:18:06,143 | 1640 | RegQueryValueExA |
Handle => 0x0000027c Data => rsaenh.dll\x00 ValueName => Image Path |
SUCCESS | 0x00000000 | |
| 09:18:06,143 | 1640 | LdrGetDllHandle |
ModuleHandle => 0x68000000 FileName => rsaenh.dll |
SUCCESS | 0x00000000 | |
| 09:18:06,143 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPAcquireContext FunctionAddress => 0x6800fb46 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:18:06,143 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPReleaseContext FunctionAddress => 0x6800f017 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:18:06,143 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPGenKey FunctionAddress => 0x6800afb1 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:18:06,143 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPDeriveKey FunctionAddress => 0x6800d086 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:18:06,143 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPDestroyKey FunctionAddress => 0x68009460 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:18:06,143 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPSetKeyParam FunctionAddress => 0x68009638 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:18:06,143 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPGetKeyParam FunctionAddress => 0x68009a22 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:18:06,143 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPExportKey FunctionAddress => 0x6800ba24 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:18:06,143 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPImportKey FunctionAddress => 0x6800bf8a ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:18:06,143 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPEncrypt FunctionAddress => 0x68006c8e ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:18:06,143 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPDecrypt FunctionAddress => 0x68007100 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:18:06,143 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPCreateHash FunctionAddress => 0x680074ba ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:18:06,143 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPHashData FunctionAddress => 0x68007e56 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:18:06,143 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPHashSessionKey FunctionAddress => 0x68007fa0 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:18:06,143 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPDestroyHash FunctionAddress => 0x680082d1 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:18:06,143 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPSignHash FunctionAddress => 0x6800da22 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:18:06,143 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPVerifySignature FunctionAddress => 0x6800df0a ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:18:06,143 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPGenRandom FunctionAddress => 0x6800d7a7 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:18:06,143 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPGetUserKey FunctionAddress => 0x68009562 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:18:06,143 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPSetProvParam FunctionAddress => 0x68009e6d ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:18:06,143 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPGetProvParam FunctionAddress => 0x68009f9c ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:18:06,143 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPSetHashParam FunctionAddress => 0x6800a56f ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:18:06,143 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPGetHashParam FunctionAddress => 0x6800c891 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:18:06,143 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPDuplicateKey FunctionAddress => 0x6800aaae ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:18:06,143 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPDuplicateHash FunctionAddress => 0x6800852e ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:18:06,143 | 1640 | RegOpenKeyExA |
Handle => 0x00000278 Registry => 0x80000002 SubKey => Software\Microsoft\Cryptography |
SUCCESS | 0x00000000 | |
| 09:18:06,143 | 1640 | RegQueryValueExA |
Handle => 0x00000278 DataLength => 37 ValueName => MachineGuid Type => 1 |
SUCCESS | 0x00000000 | |
| 09:18:06,143 | 1640 | RegQueryValueExA |
Handle => 0x00000278 Data => 99d6ed61-80b2-42d4-8c72-45c08cbdb8ae\x00 ValueName => MachineGuid |
SUCCESS | 0x00000000 | |
| 09:18:06,143 | 1640 | RegCloseKey |
Handle => 0x00000278 |
SUCCESS | 0x00000000 | |
| 09:18:06,143 | 1640 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Microsoft\Cryptography\Offload |
FAILURE | 0x00000002 | |
| 09:18:06,143 | 1640 | RegCloseKey |
Handle => 0x0000027c |
SUCCESS | 0x00000000 | |
| 09:18:06,143 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002431a8 | |
| 09:18:06,143 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002431a8 | |
| 09:18:06,143 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002431a8 | |
| 09:18:06,143 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002431a8 | |
| 09:18:06,143 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000027c |
SUCCESS | 0x00000000 | |
| 09:18:06,143 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000278 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:06,143 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002431a8 | |
| 09:18:06,143 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002431a8 | |
| 09:18:06,143 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002431a8 | |
| 09:18:06,143 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002431a8 | |
| 09:18:06,143 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000027c |
SUCCESS | 0x00000000 | |
| 09:18:06,143 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000278 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:06,143 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002431a8 | |
| 09:18:06,143 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002431a8 | |
| 09:18:06,143 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002431a8 | |
| 09:18:06,143 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002431a8 | |
| 09:18:06,143 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\Security |
SUCCESS | 0x002431a8 | |
| 09:18:06,143 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\Security\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000027c |
SUCCESS | 0x00000000 | |
| 09:18:06,143 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000278 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:06,143 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002431a8 | |
| 09:18:06,143 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002431a8 | |
| 09:18:06,143 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002431a8 | |
| 09:18:06,143 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002431a8 | |
| 09:18:06,143 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\Security |
SUCCESS | 0x002431a8 | |
| 09:18:06,143 | 1640 | NtCreateFile |
ShareAccess => 1 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\Security\services_rdrk.dat DesiredAccess => 0x00120089 CreateDisposition => 1 FileHandle => 0x0000027c |
SUCCESS | 0x00000000 | |
| 09:18:06,143 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000278 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:06,143 | 1640 | NtQueryInformationFile |
FileHandle => 0x0000027c FileInformation => \x90\xa7\x11\xb6\x8a\xa2\xcf\x01\x90\xa7\x11\xb6\x8a\xa2\xcf\x01\x90\xa7\x11\xb6\x8a\xa2\xcf\x01\x90\xa7\x11\xb6\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\xb8\x00\x00\x00\x00\x00\x00\x00\xb4\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00=L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x89\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xb4\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:06,143 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CryptUnprotectData FunctionAddress => 0x77a8baf0 ModuleHandle => 0x77a80000 |
SUCCESS | 0x00000000 | |
| 09:18:06,153 | 1640 | NtDeviceIoControlFile |
InputBuffer => 6F105CC7CAAD859B2432E13FD9D7F2F6\x00\x07\x07\x07\x07\x07\x07\x07 FileHandle => 0x00000090 OutputBuffer => 6F105CC7CAAD859B2432E13FD9D7F2F6\x00\x07\x07\x07\x07\x07\x07\x07 |
SUCCESS | 0x00000000 | |
| 09:18:06,343 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002431a8 | |
| 09:18:06,343 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000278 |
SUCCESS | 0x00000000 | |
| 09:18:06,343 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000027c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:06,343 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002431a8 | |
| 09:18:06,353 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002431a8 | |
| 09:18:06,353 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000278 |
SUCCESS | 0x00000000 | |
| 09:18:06,353 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000027c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:06,353 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002431a8 | |
| 09:18:06,353 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002431a8 | |
| 09:18:06,353 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002431a8 | |
| 09:18:06,353 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000278 |
SUCCESS | 0x00000000 | |
| 09:18:06,353 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000027c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:06,353 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002431a8 | |
| 09:18:06,353 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002431a8 | |
| 09:18:06,353 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002431a8 | |
| 09:18:06,353 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000278 |
SUCCESS | 0x00000000 | |
| 09:18:06,353 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000027c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:06,353 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002431a8 | |
| 09:18:06,353 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002431a8 | |
| 09:18:06,353 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002431a8 | |
| 09:18:06,353 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000278 |
SUCCESS | 0x00000000 | |
| 09:18:06,353 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000027c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:06,403 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002431a8 | |
| 09:18:06,403 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002431a8 | |
| 09:18:06,403 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002431a8 | |
| 09:18:06,403 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002431a8 | |
| 09:18:06,403 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000278 |
SUCCESS | 0x00000000 | |
| 09:18:06,403 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000027c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:06,403 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000278 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\x90\x8dB\xb6\x8a\xa2\xcf\x01\x90\x8dB\xb6\x8a\xa2\xcf\x01\x90\x8dB\xb6\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:06,403 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002431a8 | |
| 09:18:06,403 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002431a8 | |
| 09:18:06,403 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002431a8 | |
| 09:18:06,403 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002431a8 | |
| 09:18:06,403 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000278 |
SUCCESS | 0x00000000 | |
| 09:18:06,403 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000027c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:06,413 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000278 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\x90\x8dB\xb6\x8a\xa2\xcf\x01\x90\x8dB\xb6\x8a\xa2\xcf\x01\x90\x8dB\xb6\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:06,653 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002431a8 | |
| 09:18:06,653 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002431a8 | |
| 09:18:06,653 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002431a8 | |
| 09:18:06,653 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002431a8 | |
| 09:18:06,653 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000278 |
SUCCESS | 0x00000000 | |
| 09:18:06,663 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000027c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:06,663 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000278 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\x90\x8dB\xb6\x8a\xa2\xcf\x01\x90\x8dB\xb6\x8a\xa2\xcf\x01\x90\x8dB\xb6\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:06,663 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00237da8 | |
| 09:18:06,663 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00237da8 | |
| 09:18:06,673 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00237da8 | |
| 09:18:06,673 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00237da8 | |
| 09:18:06,673 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000278 |
SUCCESS | 0x00000000 | |
| 09:18:06,673 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000027c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:06,673 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000278 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\x90\x8dB\xb6\x8a\xa2\xcf\x01\x90\x8dB\xb6\x8a\xa2\xcf\x01\x90\x8dB\xb6\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:06,683 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002431a8 | |
| 09:18:06,683 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002431a8 | |
| 09:18:06,683 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002431a8 | |
| 09:18:06,683 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002431a8 | |
| 09:18:06,683 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000278 |
SUCCESS | 0x00000000 | |
| 09:18:06,683 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000027c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:06,693 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000278 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\x90\x8dB\xb6\x8a\xa2\xcf\x01\x90\x8dB\xb6\x8a\xa2\xcf\x01\x90\x8dB\xb6\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:06,713 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002431a8 | |
| 09:18:06,713 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002431a8 | |
| 09:18:06,713 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002431a8 | |
| 09:18:06,713 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002431a8 | |
| 09:18:06,713 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000278 |
SUCCESS | 0x00000000 | |
| 09:18:06,713 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000027c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:06,713 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000278 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\x90\x8dB\xb6\x8a\xa2\xcf\x01\x90\x8dB\xb6\x8a\xa2\xcf\x01\x90\x8dB\xb6\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:06,723 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00237da8 | |
| 09:18:06,723 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00237da8 | |
| 09:18:06,723 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00237da8 | |
| 09:18:06,723 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00237da8 | |
| 09:18:06,723 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000278 |
SUCCESS | 0x00000000 | |
| 09:18:06,723 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000027c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:06,733 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000278 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\x90\x8dB\xb6\x8a\xa2\xcf\x01\x90\x8dB\xb6\x8a\xa2\xcf\x01\x90\x8dB\xb6\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:06,733 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002431a8 | |
| 09:18:06,733 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002431a8 | |
| 09:18:06,733 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002431a8 | |
| 09:18:06,733 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002431a8 | |
| 09:18:06,733 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000278 |
SUCCESS | 0x00000000 | |
| 09:18:06,733 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000027c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:06,733 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000278 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\x90\x8dB\xb6\x8a\xa2\xcf\x01\x90\x8dB\xb6\x8a\xa2\xcf\x01\x90\x8dB\xb6\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:06,733 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00237da8 | |
| 09:18:06,733 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00237da8 | |
| 09:18:06,733 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00237da8 | |
| 09:18:06,743 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00237da8 | |
| 09:18:06,743 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000278 |
SUCCESS | 0x00000000 | |
| 09:18:06,743 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000027c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:06,743 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000278 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\x90\x8dB\xb6\x8a\xa2\xcf\x01\x90\x8dB\xb6\x8a\xa2\xcf\x01\x90\x8dB\xb6\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:06,874 | 1640 | RegOpenKeyExW |
Handle => 0x00000278 Registry => 0x80000002 SubKey => Software\Adobe\Acrobat Reader\11.0\Installer |
SUCCESS | 0x00000000 | |
| 09:18:06,874 | 1640 | RegQueryValueExW |
Handle => 0x00000278 Data => C\x00:\x00\\x00P\x00r\x00o\x00g\x00r\x00a\x00m\x00 \x00F\x00i\x00l\x00e\x00s\x00\\x00A\x00d\x00o\x00b\x00e\x00\\x00R\x00e\x00a\x00d\x00e\x00r\x00 \x001\x001\x00.\x000\x00\\x00\x00\x00 ValueName => Path |
SUCCESS | 0x00000000 | |
| 09:18:06,874 | 1640 | RegCloseKey |
Handle => 0x00000278 |
SUCCESS | 0x00000000 | |
| 09:18:06,874 | 1640 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => KERNEL32.DLL |
SUCCESS | 0x00000000 | |
| 09:18:06,884 | 1640 | LdrGetProcedureAddress |
Ordinal => 43 FunctionName => FunctionAddress => 0x7ca23a9d ModuleHandle => 0x7c9c0000 |
SUCCESS | 0x00000000 | |
| 09:18:06,884 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => ShellExecuteExW FunctionAddress => 0x7ca02f03 ModuleHandle => 0x7c9c0000 |
SUCCESS | 0x00000000 | |
| 09:18:06,884 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CoInitializeEx FunctionAddress => 0x774fef7b ModuleHandle => 0x774e0000 |
SUCCESS | 0x00000000 | |
| 09:18:06,884 | 1640 | RegOpenKeyExA |
Handle => 0x00000278 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer |
SUCCESS | 0x00000000 | |
| 09:18:06,884 | 1640 | RegQueryValueExW |
Handle => 0x00000278 DataLength => 520 ValueName => MaximizeApps Type => 33290608 |
FAILURE | 0x00000002 | |
| 09:18:06,884 | 1640 | RegOpenKeyExA |
Handle => 0x0000027c Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer |
SUCCESS | 0x00000000 | |
| 09:18:06,894 | 1640 | RegQueryValueExW |
Handle => 0x0000027c DataLength => 520 ValueName => MaximizeApps Type => 33290608 |
FAILURE | 0x00000002 | |
| 09:18:06,894 | 1640 | RegCloseKey |
Handle => 0x0000027c |
SUCCESS | 0x00000000 | |
| 09:18:06,894 | 1640 | RegCloseKey |
Handle => 0x00000278 |
SUCCESS | 0x00000000 | |
| 09:18:06,894 | 1640 | LdrLoadDll |
Flags => 33290920 BaseAddress => 0x5b860000 FileName => netapi32 |
SUCCESS | 0x00000000 | |
| 09:18:06,894 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => NetGetJoinInformation FunctionAddress => 0x5b869b54 ModuleHandle => 0x5b860000 |
SUCCESS | 0x00000000 | |
| 09:18:06,894 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => PIPE\wkssvc DesiredAccess => 0xc0100080 CreateDisposition => 1 FileHandle => 0x0000027c |
SUCCESS | 0x00000000 | |
| 09:18:06,904 | 1640 | NtSetInformationFile |
FileHandle => 0x0000027c FileInformation => |
SUCCESS | 0x00000000 | 1 time |
| 09:18:06,904 | 1640 | NtWriteFile |
Buffer => \x05\x00\x0b\x03\x10\x00\x00\x00H\x00\x00\x00\x01\x00\x00\x00\xb8\x10\xb8\x10\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x01\x00\x98\xd0\xffk\x12\xa1\x106\x983F\xc3\xf8~4Z\x01\x00\x00\x00\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x00\x00 FileHandle => 0x0000027c |
SUCCESS | 0x00000000 | |
| 09:18:06,904 | 1640 | NtReadFile |
Buffer => FileHandle => 0x0000027c |
SUCCESS | 0x00000103 | |
| 09:18:06,914 | 1640 | LdrGetDllHandle |
ModuleHandle => 0x5b860000 FileName => netapi32 |
SUCCESS | 0x00000000 | |
| 09:18:06,914 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => NetApiBufferFree FunctionAddress => 0x5b867a00 ModuleHandle => 0x5b860000 |
SUCCESS | 0x00000000 | |
| 09:18:06,914 | 1640 | RegOpenKeyExW |
Handle => 0x0000027e Registry => 0x80000000 SubKey => Drive\shellex\FolderExtensions |
SUCCESS | 0x00000000 | |
| 09:18:06,924 | 1640 | RegEnumKeyW |
Handle => 0x0000027e Name => {fbeb8a05-beee-4442-804e-409d6c4515e9} Index => 0 |
SUCCESS | 0x00000000 | |
| 09:18:06,924 | 1640 | RegOpenKeyExW |
Handle => 0x0000027a Registry => 0x80000000 SubKey => Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9} |
SUCCESS | 0x00000000 | |
| 09:18:06,924 | 1640 | RegQueryValueExW |
Handle => 0x0000027a Data => 32 ValueName => DriveMask |
SUCCESS | 0x00000000 | |
| 09:18:06,924 | 1640 | RegCloseKey |
Handle => 0x0000027a |
SUCCESS | 0x00000000 | |
| 09:18:06,924 | 1640 | RegEnumKeyW |
Handle => 0x0000027e Name => {fbeb8a05-beee-4442-804e-409d6c4515e9} Index => 1 |
FAILURE | 0x00000103 | |
| 09:18:06,924 | 1640 | RegCloseKey |
Handle => 0x0000027e |
SUCCESS | 0x00000000 | |
| 09:18:06,924 | 1640 | LdrLoadDll |
Flags => 33288956 BaseAddress => 0x7c9c0000 FileName => SHELL32.dll |
SUCCESS | 0x00000000 | |
| 09:18:06,924 | 1640 | LdrGetProcedureAddress |
Ordinal => 102 FunctionName => FunctionAddress => 0x7c9ef5e2 ModuleHandle => 0x7c9c0000 |
SUCCESS | 0x00000000 | |
| 09:18:06,924 | 1640 | LdrLoadDll |
Flags => 33288996 BaseAddress => 0x774e0000 FileName => ole32.dll |
SUCCESS | 0x00000000 | |
| 09:18:06,934 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CoTaskMemAlloc FunctionAddress => 0x774fd060 ModuleHandle => 0x774e0000 |
SUCCESS | 0x00000000 | |
| 09:18:06,934 | 1640 | LdrGetProcedureAddress |
Ordinal => 320 FunctionName => FunctionAddress => 0x773e0a75 ModuleHandle => 0x773d0000 |
SUCCESS | 0x00000000 | |
| 09:18:06,934 | 1640 | LdrGetProcedureAddress |
Ordinal => 324 FunctionName => FunctionAddress => 0x773e0c22 ModuleHandle => 0x773d0000 |
SUCCESS | 0x00000000 | |
| 09:18:06,934 | 1640 | LdrGetProcedureAddress |
Ordinal => 323 FunctionName => FunctionAddress => 0x773e0b17 ModuleHandle => 0x773d0000 |
SUCCESS | 0x00000000 | |
| 09:18:06,934 | 1640 | RegOpenKeyExW |
Handle => 0x0000027c Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer |
SUCCESS | 0x00000000 | |
| 09:18:06,934 | 1640 | RegOpenKeyExW |
Handle => 0x00000278 Registry => 0x0000027c SubKey => FileExts |
SUCCESS | 0x00000000 | |
| 09:18:06,934 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x00000278 SubKey => .exe |
FAILURE | 0x00000002 | 1 time |
| 09:18:06,934 | 1640 | LdrGetProcedureAddress |
Ordinal => 326 FunctionName => FunctionAddress => 0x773e0cc1 ModuleHandle => 0x773d0000 |
SUCCESS | 0x00000000 | |
| 09:18:06,934 | 1640 | RegOpenKeyExW |
Handle => 0x00000282 Registry => 0x80000000 SubKey => .exe |
SUCCESS | 0x00000000 | |
| 09:18:06,934 | 1640 | RegQueryValueExW |
Handle => 0x00000282 Data => e\x00x\x00e\x00f\x00i\x00l\x00e\x00\x00\x00 ValueName => |
SUCCESS | 0x00000000 | |
| 09:18:06,934 | 1640 | RegOpenKeyExW |
Handle => 0x00000286 Registry => 0x80000000 SubKey => exefile |
SUCCESS | 0x00000000 | |
| 09:18:06,934 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x00000286 SubKey => CurVer |
FAILURE | 0x00000002 | |
| 09:18:06,934 | 1640 | RegOpenKeyExW |
Handle => 0x0000028a Registry => 0x00000286 SubKey => |
SUCCESS | 0x00000000 | |
| 09:18:06,934 | 1640 | RegCloseKey |
Handle => 0x00000286 |
SUCCESS | 0x00000000 | |
| 09:18:06,934 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CoTaskMemFree FunctionAddress => 0x774fd044 ModuleHandle => 0x774e0000 |
SUCCESS | 0x00000000 | |
| 09:18:06,934 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
FAILURE | 0x00000002 | |
| 09:18:06,934 | 1640 | RegOpenKeyExW |
Handle => 0x00000284 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
SUCCESS | 0x00000000 | |
| 09:18:06,934 | 1640 | RegQueryValueExW |
Handle => 0x00000284 DataLength => 4 ValueName => DontShowSuperHidden Type => 33288660 |
FAILURE | 0x00000002 | |
| 09:18:06,934 | 1640 | RegCloseKey |
Handle => 0x00000284 |
SUCCESS | 0x00000000 | |
| 09:18:06,934 | 1640 | RegOpenKeyExW |
Handle => 0x00000284 Registry => 0x0000027c SubKey => |
SUCCESS | 0x00000000 | |
| 09:18:06,934 | 1640 | RegQueryValueExW |
Handle => 0x00000284 DataLength => 36 ValueName => ShellState Type => 3 |
SUCCESS | 0x00000000 | |
| 09:18:06,934 | 1640 | RegQueryValueExW |
Handle => 0x00000284 Data => ValueName => ShellState |
SUCCESS | 0x00000000 | |
| 09:18:06,934 | 1640 | RegCloseKey |
Handle => 0x00000284 |
SUCCESS | 0x00000000 | |
| 09:18:06,934 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
FAILURE | 0x00000002 | |
| 09:18:06,934 | 1640 | RegOpenKeyExW |
Handle => 0x00000284 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
SUCCESS | 0x00000000 | |
| 09:18:06,934 | 1640 | RegQueryValueExW |
Handle => 0x00000284 DataLength => 4 ValueName => ForceActiveDesktopOn Type => 33287992 |
FAILURE | 0x00000002 | |
| 09:18:06,934 | 1640 | RegCloseKey |
Handle => 0x00000284 |
SUCCESS | 0x00000000 | |
| 09:18:06,934 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
FAILURE | 0x00000002 | |
| 09:18:06,934 | 1640 | RegOpenKeyExW |
Handle => 0x00000284 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
SUCCESS | 0x00000000 | |
| 09:18:06,934 | 1640 | RegQueryValueExW |
Handle => 0x00000284 DataLength => 4 ValueName => NoActiveDesktop Type => 33287988 |
FAILURE | 0x00000002 | |
| 09:18:06,934 | 1640 | RegCloseKey |
Handle => 0x00000284 |
SUCCESS | 0x00000000 | |
| 09:18:06,934 | 1640 | GetSystemMetrics |
SystemMetricIndex => 4096 |
SUCCESS | 0x00000000 | 1 time |
| 09:18:06,934 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\System |
FAILURE | 0x00000002 | |
| 09:18:06,934 | 1640 | GetSystemMetrics |
SystemMetricIndex => 4096 |
SUCCESS | 0x00000000 | 1 time |
| 09:18:06,934 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
FAILURE | 0x00000002 | |
| 09:18:06,934 | 1640 | RegOpenKeyExW |
Handle => 0x00000284 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
SUCCESS | 0x00000000 | |
| 09:18:06,934 | 1640 | RegQueryValueExW |
Handle => 0x00000284 DataLength => 4 ValueName => NoWebView Type => 33287992 |
FAILURE | 0x00000002 | |
| 09:18:06,934 | 1640 | RegCloseKey |
Handle => 0x00000284 |
SUCCESS | 0x00000000 | |
| 09:18:06,944 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
FAILURE | 0x00000002 | |
| 09:18:06,944 | 1640 | RegOpenKeyExW |
Handle => 0x00000284 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
SUCCESS | 0x00000000 | |
| 09:18:06,944 | 1640 | RegQueryValueExW |
Handle => 0x00000284 DataLength => 4 ValueName => ClassicShell Type => 33287992 |
FAILURE | 0x00000002 | |
| 09:18:06,944 | 1640 | RegCloseKey |
Handle => 0x00000284 |
SUCCESS | 0x00000000 | |
| 09:18:06,944 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
FAILURE | 0x00000002 | |
| 09:18:06,944 | 1640 | RegOpenKeyExW |
Handle => 0x00000284 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
SUCCESS | 0x00000000 | |
| 09:18:06,944 | 1640 | RegQueryValueExW |
Handle => 0x00000284 DataLength => 4 ValueName => SeparateProcess Type => 33287992 |
FAILURE | 0x00000002 | |
| 09:18:06,944 | 1640 | RegCloseKey |
Handle => 0x00000284 |
SUCCESS | 0x00000000 | |
| 09:18:06,944 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
FAILURE | 0x00000002 | |
| 09:18:06,944 | 1640 | RegOpenKeyExW |
Handle => 0x00000284 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
SUCCESS | 0x00000000 | |
| 09:18:06,944 | 1640 | RegQueryValueExW |
Handle => 0x00000284 DataLength => 4 ValueName => NoNetCrawling Type => 33287992 |
FAILURE | 0x00000002 | |
| 09:18:06,944 | 1640 | RegCloseKey |
Handle => 0x00000284 |
SUCCESS | 0x00000000 | |
| 09:18:06,944 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
FAILURE | 0x00000002 | |
| 09:18:06,944 | 1640 | RegOpenKeyExW |
Handle => 0x00000284 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
SUCCESS | 0x00000000 | |
| 09:18:06,944 | 1640 | RegQueryValueExW |
Handle => 0x00000284 DataLength => 4 ValueName => NoSimpleStartMenu Type => 33287992 |
FAILURE | 0x00000002 | |
| 09:18:06,944 | 1640 | RegCloseKey |
Handle => 0x00000284 |
SUCCESS | 0x00000000 | |
| 09:18:06,944 | 1640 | RegOpenKeyExW |
Handle => 0x00000284 Registry => 0x0000027c SubKey => Advanced |
SUCCESS | 0x00000000 | |
| 09:18:06,944 | 1640 | RegQueryValueExW |
Handle => 0x00000284 Data => 2 ValueName => Hidden |
SUCCESS | 0x00000000 | |
| 09:18:06,944 | 1640 | RegQueryValueExW |
Handle => 0x00000284 Data => 1 ValueName => ShowCompColor |
SUCCESS | 0x00000000 | |
| 09:18:06,944 | 1640 | RegQueryValueExW |
Handle => 0x00000284 Data => 1 ValueName => HideFileExt |
SUCCESS | 0x00000000 | |
| 09:18:06,944 | 1640 | RegQueryValueExW |
Handle => 0x00000284 Data => 0 ValueName => DontPrettyPath |
SUCCESS | 0x00000000 | |
| 09:18:06,944 | 1640 | RegQueryValueExW |
Handle => 0x00000284 Data => 1 ValueName => ShowInfoTip |
SUCCESS | 0x00000000 | |
| 09:18:06,944 | 1640 | RegQueryValueExW |
Handle => 0x00000284 Data => 0 ValueName => HideIcons |
SUCCESS | 0x00000000 | |
| 09:18:06,944 | 1640 | RegQueryValueExW |
Handle => 0x00000284 Data => 0 ValueName => MapNetDrvBtn |
SUCCESS | 0x00000000 | |
| 09:18:06,944 | 1640 | RegQueryValueExW |
Handle => 0x00000284 Data => 1 ValueName => WebView |
SUCCESS | 0x00000000 | |
| 09:18:06,944 | 1640 | RegQueryValueExW |
Handle => 0x00000284 Data => 0 ValueName => Filter |
SUCCESS | 0x00000000 | |
| 09:18:06,944 | 1640 | RegQueryValueExW |
Handle => 0x00000284 DataLength => 4 ValueName => ShowSuperHidden Type => 33289160 |
FAILURE | 0x00000002 | |
| 09:18:06,944 | 1640 | RegQueryValueExW |
Handle => 0x00000284 Data => 0 ValueName => SeparateProcess |
SUCCESS | 0x00000000 | |
| 09:18:06,944 | 1640 | RegQueryValueExW |
Handle => 0x00000284 DataLength => 4 ValueName => NoNetCrawling Type => 33289160 |
FAILURE | 0x00000002 | |
| 09:18:06,944 | 1640 | RegCloseKey |
Handle => 0x00000284 |
SUCCESS | 0x00000000 | |
| 09:18:06,944 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x0000028a SubKey => ShellEx\IconHandler |
FAILURE | 0x00000002 | |
| 09:18:06,944 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000000 SubKey => SystemFileAssociations\.exe |
FAILURE | 0x00000002 | |
| 09:18:06,944 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000000 SubKey => SystemFileAssociations\application |
FAILURE | 0x00000002 | |
| 09:18:06,944 | 1640 | RegQueryValueExW |
Handle => 0x0000028a DataLength => 0 ValueName => DocObject Type => 0 |
FAILURE | 0x00000002 | |
| 09:18:06,944 | 1640 | RegQueryValueExW |
Handle => 0x0000028a DataLength => 0 ValueName => BrowseInPlace Type => 0 |
FAILURE | 0x00000002 | |
| 09:18:06,944 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x0000028a SubKey => Clsid |
FAILURE | 0x00000002 | |
| 09:18:06,944 | 1640 | RegOpenKeyExW |
Handle => 0x0000028e Registry => 0x80000000 SubKey => * |
SUCCESS | 0x00000000 | |
| 09:18:06,944 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x0000028e SubKey => Clsid |
FAILURE | 0x00000002 | |
| 09:18:06,944 | 1640 | RegQueryValueExW |
Handle => 0x0000028a DataLength => 0 ValueName => IsShortcut Type => 0 |
FAILURE | 0x00000002 | |
| 09:18:06,944 | 1640 | RegQueryValueExW |
Handle => 0x0000028a DataLength => 0 ValueName => AlwaysShowExt Type => 0 |
FAILURE | 0x00000002 | |
| 09:18:06,944 | 1640 | RegQueryValueExW |
Handle => 0x0000028a DataLength => 0 ValueName => NeverShowExt Type => 0 |
FAILURE | 0x00000002 | |
| 09:18:06,944 | 1640 | LdrGetProcedureAddress |
Ordinal => 388 FunctionName => FunctionAddress => 0x773e1535 ModuleHandle => 0x773d0000 |
SUCCESS | 0x00000000 | |
| 09:18:06,944 | 1640 | RegCloseKey |
Handle => 0x00000282 |
SUCCESS | 0x00000000 | |
| 09:18:06,944 | 1640 | RegCloseKey |
Handle => 0x0000028a |
SUCCESS | 0x00000000 | |
| 09:18:06,944 | 1640 | RegCloseKey |
Handle => 0x0000028e |
SUCCESS | 0x00000000 | |
| 09:18:06,944 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CoTaskMemFree FunctionAddress => 0x774fd044 ModuleHandle => 0x774e0000 |
SUCCESS | 0x00000000 | |
| 09:18:06,944 | 1640 | LdrGetProcedureAddress |
Ordinal => 328 FunctionName => FunctionAddress => 0x773e1559 ModuleHandle => 0x773d0000 |
SUCCESS | 0x00000000 | |
| 09:18:06,944 | 1640 | LdrLoadDll |
Flags => 33289120 BaseAddress => 0x77920000 FileName => SETUPAPI.dll |
SUCCESS | 0x00000000 | |
| 09:18:06,944 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CM_Get_Device_Interface_List_Size_ExW FunctionAddress => 0x77929025 ModuleHandle => 0x77920000 |
SUCCESS | 0x00000000 | |
| 09:18:06,954 | 1640 | LookupPrivilegeValueW |
SystemName => PrivilegeName => SeLoadDriverPrivilege |
SUCCESS | 0x00000001 | |
| 09:18:06,954 | 1640 | LookupPrivilegeValueW |
SystemName => PrivilegeName => SeUndockPrivilege |
SUCCESS | 0x00000001 | |
| 09:18:06,954 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CM_Get_Device_Interface_List_ExW FunctionAddress => 0x7792a15c ModuleHandle => 0x77920000 |
SUCCESS | 0x00000000 | |
| 09:18:06,954 | 1640 | NtOpenFile |
ShareAccess => 3 FileName => IDE#CdRomVBOX_CD-ROM_____________________________1.0_____#42562d3231303037333036372020202020202020#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b} DesiredAccess => 0x00100080 FileHandle => 0x000002a4 |
SUCCESS | 0x00000000 | 1 time |
| 09:18:06,954 | 1640 | DeviceIoControl |
DeviceHandle => 0x000002a4 OutBuffer => \x1c\x00\\x00D\x00e\x00v\x00i\x00c\x00e\x00\\x00C\x00d\x00R\x00o\x00m\x000\x00 IoControlCode => 5046280 InBuffer => |
SUCCESS | 0x00000001 | |
| 09:18:06,954 | 1640 | NtQueryInformationFile |
FileHandle => 0xffffffff FileInformation => \x00\x00\x00\x00\x84\xf1\xfb\x01x \x82|<\xfc\x81|\x00\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x80\x00\x00\x00\xff\xff\xff\xff\x00\x00\x00\x00\xdc\xf1\xfb\x01\xe4\xf3\xfb\x01\xe4\xf3\xfb\x01D\xf0\xfb\x01\x18\x00\x00\x00\x00\x00\x00\x00h\xef\xfb\x01@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb0\xc7$\x00h\xc3\x1f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1c\x00 |
FAILURE | 3221225508 | |
| 09:18:06,954 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => MountPointManager DesiredAccess => 0x00100080 CreateDisposition => 1 FileHandle => 0x000002a4 |
SUCCESS | 0x00000000 | |
| 09:18:06,954 | 1640 | DeviceIoControl |
DeviceHandle => 0x000002a4 OutBuffer => \xea\x01\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x18\x00\x00\x00\x1c\x00\x00\x00\\x00D\x00e\x00v\x00 IoControlCode => 7143432 InBuffer => \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x18\x00\x00\x00\x1c\x00\x00\x00\\x00D\x00e\x00v\x00i\x00c\x00e\x00\\x00C\x00d\x00R\x00o\x00m\x000\x00 |
FAILURE | 0x00000000 | |
| 09:18:06,964 | 1640 | DeviceIoControl |
DeviceHandle => 0x000002a4 OutBuffer => \xea\x01\x00\x00\x02\x00\x00\x00n\x01\x00\x00`\x00\x00\x008\x00\x00\x00\x1a\x01\x00\x00R\x01\x00\x00\x1c\x00v\x00\xce\x01\x00\x00\x1c\x00\\x008\x00\x00\x00\x1a\x01o\x00R\x01\x00\x00\x1c\x00\x00\x00\\x00?\x00?\x00\\x00I\x00D\x00E\x00#\x00C\x00d\x00R\x00o\x00m\x00V\x00B\x00O\x00X\x00_\x00C\x00D\x00-\x00R\x00O\x00M\x00_\x00_\x00_\x00_\x00_\x00_\x00_\x00_\x00_\x00_\x00_\x00_\x00_\x00_\x00_\x00_\x00_\x00_\x00_\x00_\x00_\x00_\x00_\x00_\x00_\x00_\x00_\x00_\x00_\x001\x00.\x000\x00_\x00_\x00_\x00_\x00_\x00#\x004\x002\x005\x006\x002\x00d\x003\x002\x003\x001\x003\x000\x003\x000\x003\x007\x003\x003\x003\x000\x003\x006\x003\x007\x002\x000\x002\x000\x002\x000\x002\x000\x002\x000\x002\x000\x002\x000\x00 IoControlCode => 7143432 InBuffer => \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x18\x00\x00\x00\x1c\x00\x00\x00\\x00D\x00e\x00v\x00i\x00c\x00e\x00\\x00C\x00d\x00R\x00o\x00m\x000\x00 |
SUCCESS | 0x00000001 | |
| 09:18:06,964 | 1640 | RegOpenKeyExW |
Handle => 0x000002a4 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume |
SUCCESS | 0x00000000 | |
| 09:18:06,964 | 1640 | RegOpenKeyExW |
Handle => 0x000002a8 Registry => 0x000002a4 SubKey => {e6c716a0-b561-11e1-9849-806d6172696f}\ |
SUCCESS | 0x00000000 | |
| 09:18:06,964 | 1640 | RegCloseKey |
Handle => 0x000002a4 |
SUCCESS | 0x00000000 | |
| 09:18:06,964 | 1640 | RegQueryValueExW |
Handle => 0x000002a8 Data => ValueName => Data |
SUCCESS | 0x00000000 | |
| 09:18:06,964 | 1640 | RegCloseKey |
Handle => 0x000002a8 |
SUCCESS | 0x00000000 | |
| 09:18:06,964 | 1640 | RegOpenKeyExW |
Handle => 0x000002a8 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume |
SUCCESS | 0x00000000 | |
| 09:18:06,964 | 1640 | RegOpenKeyExW |
Handle => 0x000002a4 Registry => 0x000002a8 SubKey => {e6c716a0-b561-11e1-9849-806d6172696f}\ |
SUCCESS | 0x00000000 | |
| 09:18:06,964 | 1640 | RegCloseKey |
Handle => 0x000002a8 |
SUCCESS | 0x00000000 | |
| 09:18:06,964 | 1640 | RegQueryValueExW |
Handle => 0x000002a4 Data => 1 ValueName => Generation |
SUCCESS | 0x00000000 | |
| 09:18:06,964 | 1640 | RegCloseKey |
Handle => 0x000002a4 |
SUCCESS | 0x00000000 | |
| 09:18:06,964 | 1640 | LdrGetProcedureAddress |
Ordinal => 334 FunctionName => FunctionAddress => 0x773e0f5a ModuleHandle => 0x773d0000 |
SUCCESS | 0x00000000 | |
| 09:18:06,964 | 1640 | NtOpenFile |
ShareAccess => 3 FileName => STORAGE#Volume#1&30a96598&0&SignatureC7EDC7EDOffset7E00Length27F4DB200#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b} DesiredAccess => 0x00100080 FileHandle => 0x000002a4 |
SUCCESS | 0x00000000 | 1 time |
| 09:18:06,964 | 1640 | DeviceIoControl |
DeviceHandle => 0x000002a4 OutBuffer => .\x00\\x00D\x00e\x00v\x00i\x00c\x00e\x00\\x00H\x00a\x00r\x00d\x00d\x00i\x00s\x00k\x00V\x00o\x00l\x00u\x00m\x00e\x001\x00 IoControlCode => 5046280 InBuffer => |
SUCCESS | 0x00000001 | |
| 09:18:06,964 | 1640 | NtQueryInformationFile |
FileHandle => 0xffffffff FileInformation => \x00\x00\x00\x00\x84\xf1\xfb\x01x \x82|<\xfc\x81|\x00\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x80\x00\x00\x00\xff\xff\xff\xff\x00\x00\x00\x00\xdc\xf1\xfb\x01\xe4\xf3\xfb\x01\xe4\xf3\xfb\x01S\x00o\x00\x18\x00\x00\x00\x00\x00\x00\x00h\xef\xfb\x01@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xd8\xc7$\x00\xc8\x14 \x00\x00\x00\x00\x00\x00\x00\x00\x00.\x00 |
FAILURE | 3221225508 | |
| 09:18:06,964 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => MountPointManager DesiredAccess => 0x00100080 CreateDisposition => 1 FileHandle => 0x000002a4 |
SUCCESS | 0x00000000 | |
| 09:18:06,964 | 1640 | DeviceIoControl |
DeviceHandle => 0x000002a4 OutBuffer => \xee\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x18\x00\x00\x00.\x00\x00\x00\\x00D\x00e\x00v\x00 IoControlCode => 7143432 InBuffer => \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x18\x00\x00\x00.\x00\x00\x00\\x00D\x00e\x00v\x00i\x00c\x00e\x00\\x00H\x00a\x00r\x00d\x00d\x00i\x00s\x00k\x00V\x00o\x00l\x00u\x00m\x00e\x001\x00 |
FAILURE | 0x00000000 | |
| 09:18:06,974 | 1640 | DeviceIoControl |
DeviceHandle => 0x000002a4 OutBuffer => \xee\x00\x00\x00\x02\x00\x00\x00r\x00\x00\x00`\x00\x00\x008\x00\x00\x00\x0c\x00\x00\x00D\x00\x00\x00.\x00v\x00\xd2\x00\x00\x00\x1c\x00\\x008\x00\x00\x00\x0c\x00d\x00D\x00\x00\x00.\x00k\x00\xed\xc7\xed\xc7\x00~\x00\x00\x00\x00\x00\x00\\x00D\x00e\x00v\x00i\x00c\x00e\x00\\x00H\x00a\x00r\x00d\x00d\x00i\x00s\x00k\x00V\x00o\x00l\x00u\x00m\x00e\x001\x00\\x00?\x00?\x00\\x00V\x00o\x00l\x00u\x00m\x00e\x00{\x00e\x006\x00c\x007\x001\x006\x00a\x002\x00-\x00b\x005\x006\x001\x00-\x001\x001\x00e\x001\x00-\x009\x008\x004\x009\x00-\x008\x000\x006\x00d\x006\x001\x007\x002\x006\x009\x006\x00f\x00}\x00\\x00D\x00o\x00s\x00D\x00e\x00v\x00i\x00c\x00e\x00s\x00\\x00C\x00:\x00 IoControlCode => 7143432 InBuffer => \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x18\x00\x00\x00.\x00\x00\x00\\x00D\x00e\x00v\x00i\x00c\x00e\x00\\x00H\x00a\x00r\x00d\x00d\x00i\x00s\x00k\x00V\x00o\x00l\x00u\x00m\x00e\x001\x00 |
SUCCESS | 0x00000001 | |
| 09:18:06,974 | 1640 | RegOpenKeyExW |
Handle => 0x000002a4 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume |
SUCCESS | 0x00000000 | |
| 09:18:06,974 | 1640 | RegOpenKeyExW |
Handle => 0x000002a8 Registry => 0x000002a4 SubKey => {e6c716a2-b561-11e1-9849-806d6172696f}\ |
SUCCESS | 0x00000000 | |
| 09:18:06,974 | 1640 | RegCloseKey |
Handle => 0x000002a4 |
SUCCESS | 0x00000000 | |
| 09:18:06,974 | 1640 | RegQueryValueExW |
Handle => 0x000002a8 Data => ValueName => Data |
SUCCESS | 0x00000000 | |
| 09:18:06,974 | 1640 | RegCloseKey |
Handle => 0x000002a8 |
SUCCESS | 0x00000000 | |
| 09:18:06,974 | 1640 | RegOpenKeyExW |
Handle => 0x000002a8 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume |
SUCCESS | 0x00000000 | |
| 09:18:06,974 | 1640 | RegOpenKeyExW |
Handle => 0x000002a4 Registry => 0x000002a8 SubKey => {e6c716a2-b561-11e1-9849-806d6172696f}\ |
SUCCESS | 0x00000000 | |
| 09:18:06,974 | 1640 | RegCloseKey |
Handle => 0x000002a8 |
SUCCESS | 0x00000000 | |
| 09:18:06,974 | 1640 | RegQueryValueExW |
Handle => 0x000002a4 Data => 1 ValueName => Generation |
SUCCESS | 0x00000000 | |
| 09:18:06,974 | 1640 | RegCloseKey |
Handle => 0x000002a4 |
SUCCESS | 0x00000000 | |
| 09:18:06,974 | 1640 | LdrGetProcedureAddress |
Ordinal => 332 FunctionName => FunctionAddress => 0x773e0df4 ModuleHandle => 0x773d0000 |
SUCCESS | 0x00000000 | |
| 09:18:06,974 | 1640 | NtQueryInformationFile |
FileHandle => 0xffffffff FileInformation => |
FAILURE | 3221225508 | |
| 09:18:06,974 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => MountPointManager DesiredAccess => 0x00100080 CreateDisposition => 1 FileHandle => 0x000002a4 |
SUCCESS | 0x00000000 | |
| 09:18:06,974 | 1640 | DeviceIoControl |
DeviceHandle => 0x000002a4 OutBuffer => \x08\x00\x00\x00 IoControlCode => 7143476 InBuffer => `\x00\\x00?\x00?\x00\\x00V\x00o\x00l\x00u\x00m\x00e\x00{\x00e\x006\x00c\x007\x001\x006\x00a\x002\x00-\x00b\x005\x006\x001\x00-\x001\x001\x00e\x001\x00-\x009\x008\x004\x009\x00-\x008\x000\x006\x00d\x006\x001\x007\x002\x006\x009\x006\x00f\x00}\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 |
FAILURE | 0x00000000 | |
| 09:18:06,974 | 1640 | DeviceIoControl |
DeviceHandle => 0x000002a4 OutBuffer => \x08\x00\x00\x00C\x00:\x00\x00\x00\x00\x00 IoControlCode => 7143476 InBuffer => `\x00\\x00?\x00?\x00\\x00V\x00o\x00l\x00u\x00m\x00e\x00{\x00e\x006\x00c\x007\x001\x006\x00a\x002\x00-\x00b\x005\x006\x001\x00-\x001\x001\x00e\x001\x00-\x009\x008\x004\x009\x00-\x008\x000\x006\x00d\x006\x001\x007\x002\x006\x009\x006\x00f\x00}\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000001 | |
| 09:18:06,974 | 1640 | NtQueryInformationFile |
FileHandle => 0xffffffff FileInformation => \xbb\x01\x91|\x84\xf4\xfb\x01\x7f\x0e\x82|<\xfc\x81|\x00\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x80\x00\x00\x00\xff\xff\xff\xff\xe0b\x1e\x00\xfc\x0c\x82|\x80~#\x00b\x00d\x00\xd8\x9b\x18\x00h\xfc\xfb\x01\xc0\x9a\x83|\xc0\xf4\xfb\x01\x18\x0e\xa0|\xd8\x9b\x18\x00\x80~#\x00\x05\x00\x00\x00\xb8\xf4\xfb\x01\x00\x00\x00\x00.\x93\x80|\x00\x00\x00\x00\x08\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00h\x15>w\x05\x00\x00\x00\x01H\x00\x00\xd8\xf4\xfb\x01\x8e\x0c\xa0|\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\xf8\xf4\xfb\x01Y\x0b\xa0|\x00\x00\x00\x00\xa8\xf5\xbc|\x05@\x00\x80\\x00\x00\x00\x01H\x00\x00\x01H\x00\x00 \xf5\xfb\x01%\x0c\xa0|\x00\x00\x00\x00\xa8\xf5\xbc|\x00\x00\x00\x00h\xfc\xfb\x01\xdcF_w\xc8\xd4Ow\xff\xff\xff\xff\x01H\x00\x00<\xf5\xfb\x01\xba\xa0\x9e|\x02\x00\x00\x00\x00\x00\x00\x00\xc02$\x00\x03\x00\x07\x80\xa4\xf5\xfb\x01p\xf5\xfb\x01 |
FAILURE | 3221225508 | |
| 09:18:06,974 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => MountPointManager DesiredAccess => 0x00100080 CreateDisposition => 1 FileHandle => 0x000002a4 |
SUCCESS | 0x00000000 | |
| 09:18:06,974 | 1640 | DeviceIoControl |
DeviceHandle => 0x000002a4 OutBuffer => \x08\x00\x00\x00 IoControlCode => 7143476 InBuffer => `\x00\\x00?\x00?\x00\\x00V\x00o\x00l\x00u\x00m\x00e\x00{\x00e\x006\x00c\x007\x001\x006\x00a\x002\x00-\x00b\x005\x006\x001\x00-\x001\x001\x00e\x001\x00-\x009\x008\x004\x009\x00-\x008\x000\x006\x00d\x006\x001\x007\x002\x006\x009\x006\x00f\x00}\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 |
FAILURE | 0x00000000 | |
| 09:18:06,974 | 1640 | DeviceIoControl |
DeviceHandle => 0x000002a4 OutBuffer => \x08\x00\x00\x00C\x00:\x00\x00\x00\x00\x00 IoControlCode => 7143476 InBuffer => `\x00\\x00?\x00?\x00\\x00V\x00o\x00l\x00u\x00m\x00e\x00{\x00e\x006\x00c\x007\x001\x006\x00a\x002\x00-\x00b\x005\x006\x001\x00-\x001\x001\x00e\x001\x00-\x009\x008\x004\x009\x00-\x008\x000\x006\x00d\x006\x001\x007\x002\x006\x009\x006\x00f\x00}\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000001 | |
| 09:18:06,974 | 1640 | RegCreateKeyExW |
Handle => 0x000002a4 Access => 33554432 Registry => 0x80000001 Class => SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e6c716a2-b561-11e1-9849-806d6172696f}\ |
SUCCESS | 0x00000000 | |
| 09:18:06,974 | 1640 | RegSetValueExW |
Handle => 0x000002a4 Buffer => D\x00r\x00i\x00v\x00e\x00\x00\x00 ValueName => BaseClass Type => 1 |
SUCCESS | 0x00000000 | |
| 09:18:06,974 | 1640 | RegCloseKey |
Handle => 0x000002a4 |
SUCCESS | 0x00000000 | |
| 09:18:06,974 | 1640 | NtQueryInformationFile |
FileHandle => 0xffffffff FileInformation => @\x00\x91|\x84\xf4\xfb\x01\x7f\x0e\x82|<\xfc\x81|\x00\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x80\x00\x00\x00\xff\xff\xff\xff\x10b\x1e\x00\xfc\x0c\x82|\x80~#\x00b\x00d\x00h\x9b\x18\x00\x80~#\x00h\xfc\xfb\x01\xc0\xf4\xfb\x01\xde \xa0|h\x9b\x18\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb8\xf4\xfb\x01\x00\x00\x00\x00.\x93\x80|\x00\x00\x00\x00\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00h\x15>w\x05\x00\x00\x00\x01H\x00\x00\xd8\xf4\xfb\x01\x8e\x0c\xa0|\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\xf8\xf4\xfb\x01Y\x0b\xa0|\x00\x00\x00\x00\xa8\xf5\xbc|\x05@\x00\x80\\x00\x00\x00\x01H\x00\x00\x01H\x00\x00 \xf5\xfb\x01%\x0c\xa0|\x00\x00\x00\x00\xa8\xf5\xbc|\x00\x00\x00\x00h\xfc\xfb\x01\xdcF_w\xc8\xd4Ow\xff\xff\xff\xff\x01H\x00\x00<\xf5\xfb\x01\xba\xa0\x9e|\x02\x00\x00\x00\x00\x00\x00\x00\xc02$\x00\x03\x00\x07\x80\xa4\xf5\xfb\x01p\xf5\xfb\x01 |
FAILURE | 3221225508 | |
| 09:18:06,984 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => MountPointManager DesiredAccess => 0x00100080 CreateDisposition => 1 FileHandle => 0x000002a4 |
SUCCESS | 0x00000000 | |
| 09:18:06,984 | 1640 | DeviceIoControl |
DeviceHandle => 0x000002a4 OutBuffer => \x08\x00\x00\x00 IoControlCode => 7143476 InBuffer => `\x00\\x00?\x00?\x00\\x00V\x00o\x00l\x00u\x00m\x00e\x00{\x00e\x006\x00c\x007\x001\x006\x00a\x000\x00-\x00b\x005\x006\x001\x00-\x001\x001\x00e\x001\x00-\x009\x008\x004\x009\x00-\x008\x000\x006\x00d\x006\x001\x007\x002\x006\x009\x006\x00f\x00}\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 |
FAILURE | 0x00000000 | |
| 09:18:06,984 | 1640 | DeviceIoControl |
DeviceHandle => 0x000002a4 OutBuffer => \x08\x00\x00\x00D\x00:\x00\x00\x00\x00\x00 IoControlCode => 7143476 InBuffer => `\x00\\x00?\x00?\x00\\x00V\x00o\x00l\x00u\x00m\x00e\x00{\x00e\x006\x00c\x007\x001\x006\x00a\x000\x00-\x00b\x005\x006\x001\x00-\x001\x001\x00e\x001\x00-\x009\x008\x004\x009\x00-\x008\x000\x006\x00d\x006\x001\x007\x002\x006\x009\x006\x00f\x00}\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000001 | |
| 09:18:06,984 | 1640 | NtQueryInformationFile |
FileHandle => 0xffffffff FileInformation => \xbb\x01\x91|\x84\xf4\xfb\x01\x7f\x0e\x82|<\xfc\x81|\x00\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x80\x00\x00\x00\xff\xff\xff\xff\x10b\x1e\x00\xfc\x0c\x82|\x80~#\x00b\x00d\x00h\x9b\x18\x00h\xfc\xfb\x01\xc0\x9a\x83|\xc0\xf4\xfb\x01\x18\x0e\xa0|h\x9b\x18\x00\x80~#\x00\x05\x00\x00\x00\xb8\xf4\xfb\x01\x00\x00\x00\x00.\x93\x80|\x00\x00\x00\x00\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00h\x15>w\x05\x00\x00\x00\x01H\x00\x00\xd8\xf4\xfb\x01\x8e\x0c\xa0|\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\xf8\xf4\xfb\x01Y\x0b\xa0|\x00\x00\x00\x00\xa8\xf5\xbc|\x05@\x00\x80\\x00\x00\x00\x01H\x00\x00\x01H\x00\x00 \xf5\xfb\x01%\x0c\xa0|\x00\x00\x00\x00\xa8\xf5\xbc|\x00\x00\x00\x00h\xfc\xfb\x01\xdcF_w\xc8\xd4Ow\xff\xff\xff\xff\x01H\x00\x00<\xf5\xfb\x01\xba\xa0\x9e|\x02\x00\x00\x00\x00\x00\x00\x00\xc02$\x00\x03\x00\x07\x80\xa4\xf5\xfb\x01p\xf5\xfb\x01 |
FAILURE | 3221225508 | |
| 09:18:06,984 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => MountPointManager DesiredAccess => 0x00100080 CreateDisposition => 1 FileHandle => 0x000002a4 |
SUCCESS | 0x00000000 | |
| 09:18:06,984 | 1640 | DeviceIoControl |
DeviceHandle => 0x000002a4 OutBuffer => \x08\x00\x00\x00 IoControlCode => 7143476 InBuffer => `\x00\\x00?\x00?\x00\\x00V\x00o\x00l\x00u\x00m\x00e\x00{\x00e\x006\x00c\x007\x001\x006\x00a\x000\x00-\x00b\x005\x006\x001\x00-\x001\x001\x00e\x001\x00-\x009\x008\x004\x009\x00-\x008\x000\x006\x00d\x006\x001\x007\x002\x006\x009\x006\x00f\x00}\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 |
FAILURE | 0x00000000 | |
| 09:18:06,994 | 1640 | DeviceIoControl |
DeviceHandle => 0x000002a4 OutBuffer => \x08\x00\x00\x00D\x00:\x00\x00\x00\x00\x00 IoControlCode => 7143476 InBuffer => `\x00\\x00?\x00?\x00\\x00V\x00o\x00l\x00u\x00m\x00e\x00{\x00e\x006\x00c\x007\x001\x006\x00a\x000\x00-\x00b\x005\x006\x001\x00-\x001\x001\x00e\x001\x00-\x009\x008\x004\x009\x00-\x008\x000\x006\x00d\x006\x001\x007\x002\x006\x009\x006\x00f\x00}\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000001 | |
| 09:18:06,994 | 1640 | RegCreateKeyExW |
Handle => 0x000002a4 Access => 33554432 Registry => 0x80000001 Class => SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e6c716a0-b561-11e1-9849-806d6172696f}\ |
SUCCESS | 0x00000000 | |
| 09:18:06,994 | 1640 | RegSetValueExW |
Handle => 0x000002a4 Buffer => D\x00r\x00i\x00v\x00e\x00\x00\x00 ValueName => BaseClass Type => 1 |
SUCCESS | 0x00000000 | |
| 09:18:06,994 | 1640 | RegCloseKey |
Handle => 0x000002a4 |
SUCCESS | 0x00000000 | |
| 09:18:06,994 | 1640 | RegOpenKeyExW |
Handle => 0x000002a4 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume |
SUCCESS | 0x00000000 | |
| 09:18:06,994 | 1640 | RegOpenKeyExW |
Handle => 0x000002a8 Registry => 0x000002a4 SubKey => {e6c716a2-b561-11e1-9849-806d6172696f}\ |
SUCCESS | 0x00000000 | |
| 09:18:06,994 | 1640 | RegCloseKey |
Handle => 0x000002a4 |
SUCCESS | 0x00000000 | |
| 09:18:06,994 | 1640 | RegQueryValueExW |
Handle => 0x000002a8 Data => 1 ValueName => Generation |
SUCCESS | 0x00000000 | |
| 09:18:06,994 | 1640 | RegCloseKey |
Handle => 0x000002a8 |
SUCCESS | 0x00000000 | |
| 09:18:06,994 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings |
SUCCESS | 0x002432f8 | |
| 09:18:06,994 | 1640 | RegOpenKeyExW |
Handle => 0x000002aa Registry => 0x80000000 SubKey => Directory |
SUCCESS | 0x00000000 | |
| 09:18:06,994 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x000002aa SubKey => CurVer |
FAILURE | 0x00000002 | |
| 09:18:06,994 | 1640 | RegOpenKeyExW |
Handle => 0x000002a6 Registry => 0x000002aa SubKey => |
SUCCESS | 0x00000000 | |
| 09:18:06,994 | 1640 | RegCloseKey |
Handle => 0x000002aa |
SUCCESS | 0x00000000 | |
| 09:18:06,994 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x000002a6 SubKey => ShellEx\IconHandler |
FAILURE | 0x00000002 | |
| 09:18:06,994 | 1640 | RegQueryValueExW |
Handle => 0x000002a6 DataLength => 0 ValueName => DocObject Type => 0 |
FAILURE | 0x00000002 | |
| 09:18:06,994 | 1640 | RegQueryValueExW |
Handle => 0x000002a6 DataLength => 0 ValueName => BrowseInPlace Type => 0 |
FAILURE | 0x00000002 | |
| 09:18:06,994 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x000002a6 SubKey => Clsid |
FAILURE | 0x00000002 | |
| 09:18:06,994 | 1640 | RegOpenKeyExW |
Handle => 0x000002aa Registry => 0x80000000 SubKey => Folder |
SUCCESS | 0x00000000 | |
| 09:18:06,994 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x000002aa SubKey => Clsid |
FAILURE | 0x00000002 | |
| 09:18:06,994 | 1640 | RegQueryValueExW |
Handle => 0x000002a6 DataLength => 0 ValueName => IsShortcut Type => 0 |
FAILURE | 0x00000002 | |
| 09:18:06,994 | 1640 | RegQueryValueExW |
Handle => 0x000002a6 DataLength => 2 ValueName => AlwaysShowExt Type => 1 |
SUCCESS | 0x00000000 | |
| 09:18:06,994 | 1640 | RegQueryValueExW |
Handle => 0x000002a6 DataLength => 0 ValueName => NeverShowExt Type => 0 |
FAILURE | 0x00000002 | |
| 09:18:06,994 | 1640 | RegCloseKey |
Handle => 0x000002a6 |
SUCCESS | 0x00000000 | |
| 09:18:06,994 | 1640 | RegCloseKey |
Handle => 0x000002aa |
SUCCESS | 0x00000000 | |
| 09:18:06,994 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002432f8 | |
| 09:18:06,994 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\My Documents |
SUCCESS | 0x002432f8 | |
| 09:18:06,994 | 1640 | LdrGetProcedureAddress |
Ordinal => 66 FunctionName => FunctionAddress => 0x7c9f063c ModuleHandle => 0x7c9c0000 |
SUCCESS | 0x00000000 | |
| 09:18:06,994 | 1640 | LdrGetProcedureAddress |
Ordinal => 100 FunctionName => FunctionAddress => 0x7c9ec059 ModuleHandle => 0x7c9c0000 |
SUCCESS | 0x00000000 | |
| 09:18:06,994 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
FAILURE | 0x00000002 | |
| 09:18:06,994 | 1640 | RegOpenKeyExW |
Handle => 0x000002a8 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
SUCCESS | 0x00000000 | |
| 09:18:06,994 | 1640 | RegQueryValueExW |
Handle => 0x000002a8 DataLength => 4 ValueName => UseDesktopIniCache Type => 33282048 |
FAILURE | 0x00000002 | |
| 09:18:06,994 | 1640 | RegCloseKey |
Handle => 0x000002a8 |
SUCCESS | 0x00000000 | |
| 09:18:06,994 | 1640 | NtOpenFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\My Documents\desktop.ini DesiredAccess => 0x80100000 FileHandle => 0x000002a8 |
SUCCESS | 0x00000000 | |
| 09:18:06,994 | 1640 | NtQueryInformationFile |
FileHandle => 0x000002a8 FileInformation => P\x00\x00\x00\x00\x00\x00\x00J\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:18:07,004 | 1640 | NtReadFile |
Buffer => [DeleteOnCopy]
Owner=TDW
Personalized=5
PersonalizedName=My Documents
FileHandle => 0x000002a8 |
SUCCESS | 0x00000000 | |
| 09:18:07,004 | 1640 | NtFreeVirtualMemory |
FreeType => 0x00008000 ProcessHandle => 0xffffffff RegionSize => 0x00101000 BaseAddress => 0x01fc0000 |
SUCCESS | 0x00000000 | |
| 09:18:07,004 | 1640 | NtOpenFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\My Documents\desktop.ini DesiredAccess => 0x80100000 FileHandle => 0x000002a8 |
SUCCESS | 0x00000000 | |
| 09:18:07,004 | 1640 | NtQueryInformationFile |
FileHandle => 0x000002a8 FileInformation => P\x00\x00\x00\x00\x00\x00\x00J\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:18:07,004 | 1640 | NtReadFile |
Buffer => [DeleteOnCopy]
Owner=TDW
Personalized=5
PersonalizedName=My Documents
FileHandle => 0x000002a8 |
SUCCESS | 0x00000000 | |
| 09:18:07,004 | 1640 | NtFreeVirtualMemory |
FreeType => 0x00008000 ProcessHandle => 0xffffffff RegionSize => 0x00101000 BaseAddress => 0x01fc0000 |
SUCCESS | 0x00000000 | |
| 09:18:07,004 | 1640 | NtOpenFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\My Documents\desktop.ini DesiredAccess => 0x80100000 FileHandle => 0x000002a8 |
SUCCESS | 0x00000000 | |
| 09:18:07,004 | 1640 | NtQueryInformationFile |
FileHandle => 0x000002a8 FileInformation => P\x00\x00\x00\x00\x00\x00\x00J\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:18:07,004 | 1640 | NtReadFile |
Buffer => [DeleteOnCopy]
Owner=TDW
Personalized=5
PersonalizedName=My Documents
FileHandle => 0x000002a8 |
SUCCESS | 0x00000000 | |
| 09:18:07,004 | 1640 | NtFreeVirtualMemory |
FreeType => 0x00008000 ProcessHandle => 0xffffffff RegionSize => 0x00101000 BaseAddress => 0x01fc0000 |
SUCCESS | 0x00000000 | |
| 09:18:07,004 | 1640 | NtOpenFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\My Documents\desktop.ini DesiredAccess => 0x80100000 FileHandle => 0x000002a8 |
SUCCESS | 0x00000000 | |
| 09:18:07,004 | 1640 | NtQueryInformationFile |
FileHandle => 0x000002a8 FileInformation => P\x00\x00\x00\x00\x00\x00\x00J\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:18:07,004 | 1640 | NtReadFile |
Buffer => [DeleteOnCopy]
Owner=TDW
Personalized=5
PersonalizedName=My Documents
FileHandle => 0x000002a8 |
SUCCESS | 0x00000000 | |
| 09:18:07,004 | 1640 | NtFreeVirtualMemory |
FreeType => 0x00008000 ProcessHandle => 0xffffffff RegionSize => 0x00101000 BaseAddress => 0x01fc0000 |
SUCCESS | 0x00000000 | |
| 09:18:07,004 | 1640 | NtOpenFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\My Documents\desktop.ini DesiredAccess => 0x80100000 FileHandle => 0x000002a8 |
SUCCESS | 0x00000000 | |
| 09:18:07,004 | 1640 | NtQueryInformationFile |
FileHandle => 0x000002a8 FileInformation => P\x00\x00\x00\x00\x00\x00\x00J\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:18:07,004 | 1640 | NtReadFile |
Buffer => [DeleteOnCopy]
Owner=TDW
Personalized=5
PersonalizedName=My Documents
FileHandle => 0x000002a8 |
SUCCESS | 0x00000000 | |
| 09:18:07,004 | 1640 | NtFreeVirtualMemory |
FreeType => 0x00008000 ProcessHandle => 0xffffffff RegionSize => 0x00101000 BaseAddress => 0x01fc0000 |
SUCCESS | 0x00000000 | |
| 09:18:07,004 | 1640 | NtOpenFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\My Documents\desktop.ini DesiredAccess => 0x80100000 FileHandle => 0x000002a8 |
SUCCESS | 0x00000000 | |
| 09:18:07,004 | 1640 | NtQueryInformationFile |
FileHandle => 0x000002a8 FileInformation => P\x00\x00\x00\x00\x00\x00\x00J\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:18:07,004 | 1640 | NtReadFile |
Buffer => [DeleteOnCopy]
Owner=TDW
Personalized=5
PersonalizedName=My Documents
FileHandle => 0x000002a8 |
SUCCESS | 0x00000000 | |
| 09:18:07,004 | 1640 | NtFreeVirtualMemory |
FreeType => 0x00008000 ProcessHandle => 0xffffffff RegionSize => 0x00101000 BaseAddress => 0x01fc0000 |
SUCCESS | 0x00000000 | |
| 09:18:07,004 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CoUninitialize FunctionAddress => 0x774fee46 ModuleHandle => 0x774e0000 |
SUCCESS | 0x00000000 | |
| 09:18:07,004 | 1640 | RegCreateKeyExW |
Handle => 0x000002a8 Access => 33554432 Registry => 0x80000002 Class => SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders |
SUCCESS | 0x00000000 | |
| 09:18:07,004 | 1640 | RegQueryValueExW |
Handle => 0x000002a8 Data => %\x00A\x00L\x00L\x00U\x00S\x00E\x00R\x00S\x00P\x00R\x00O\x00F\x00I\x00L\x00E\x00%\x00\\x00D\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00s\x00\x00\x00 ValueName => Common Documents |
SUCCESS | 0x00000000 | |
| 09:18:07,014 | 1640 | RegCloseKey |
Handle => 0x000002a8 |
SUCCESS | 0x00000000 | |
| 09:18:07,014 | 1640 | RegCreateKeyExW |
Handle => 0x000002a8 Access => 33554432 Registry => 0x80000002 Class => SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders |
SUCCESS | 0x00000000 | |
| 09:18:07,014 | 1640 | RegSetValueExW |
Handle => 0x000002a8 Buffer => C\x00:\x00\\x00D\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00s\x00 \x00a\x00n\x00d\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00A\x00l\x00l\x00 \x00U\x00s\x00e\x00r\x00s\x00\\x00D\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00s\x00\x00\x00 ValueName => Common Documents Type => 1 |
SUCCESS | 0x00000000 | |
| 09:18:07,014 | 1640 | RegCloseKey |
Handle => 0x000002a8 |
SUCCESS | 0x00000000 | |
| 09:18:07,014 | 1640 | RegOpenKeyExW |
Handle => 0x000002a8 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume |
SUCCESS | 0x00000000 | |
| 09:18:07,014 | 1640 | RegOpenKeyExW |
Handle => 0x000002a4 Registry => 0x000002a8 SubKey => {e6c716a2-b561-11e1-9849-806d6172696f}\ |
SUCCESS | 0x00000000 | |
| 09:18:07,014 | 1640 | RegCloseKey |
Handle => 0x000002a8 |
SUCCESS | 0x00000000 | |
| 09:18:07,014 | 1640 | RegQueryValueExW |
Handle => 0x000002a4 Data => 1 ValueName => Generation |
SUCCESS | 0x00000000 | |
| 09:18:07,014 | 1640 | RegCloseKey |
Handle => 0x000002a4 |
SUCCESS | 0x00000000 | |
| 09:18:07,014 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings |
SUCCESS | 0x00243368 | |
| 09:18:07,014 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\All Users |
SUCCESS | 0x00243368 | |
| 09:18:07,014 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\All Users\Documents |
SUCCESS | 0x00243368 | |
| 09:18:07,014 | 1640 | NtOpenFile |
ShareAccess => 7 FileName => C:\Documents and Settings\All Users\Documents\desktop.ini DesiredAccess => 0x80100000 FileHandle => 0x000002a4 |
SUCCESS | 0x00000000 | |
| 09:18:07,014 | 1640 | NtQueryInformationFile |
FileHandle => 0x000002a4 FileInformation => @\x00\x00\x00\x00\x00\x00\x00>\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:18:07,014 | 1640 | NtReadFile |
Buffer => [.ShellClassInfo]
LocalizedResourceName=@shell32.dll,-21785
FileHandle => 0x000002a4 |
SUCCESS | 0x00000000 | |
| 09:18:07,014 | 1640 | NtFreeVirtualMemory |
FreeType => 0x00008000 ProcessHandle => 0xffffffff RegionSize => 0x00101000 BaseAddress => 0x01fc0000 |
SUCCESS | 0x00000000 | |
| 09:18:07,014 | 1640 | NtOpenFile |
ShareAccess => 7 FileName => C:\Documents and Settings\All Users\Documents\desktop.ini DesiredAccess => 0x80100000 FileHandle => 0x000002a4 |
SUCCESS | 0x00000000 | |
| 09:18:07,014 | 1640 | NtQueryInformationFile |
FileHandle => 0x000002a4 FileInformation => @\x00\x00\x00\x00\x00\x00\x00>\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:18:07,014 | 1640 | NtReadFile |
Buffer => [.ShellClassInfo]
LocalizedResourceName=@shell32.dll,-21785
FileHandle => 0x000002a4 |
SUCCESS | 0x00000000 | |
| 09:18:07,014 | 1640 | NtFreeVirtualMemory |
FreeType => 0x00008000 ProcessHandle => 0xffffffff RegionSize => 0x00101000 BaseAddress => 0x01fc0000 |
SUCCESS | 0x00000000 | |
| 09:18:07,014 | 1640 | NtOpenFile |
ShareAccess => 7 FileName => C:\Documents and Settings\All Users\Documents\desktop.ini DesiredAccess => 0x80100000 FileHandle => 0x000002a4 |
SUCCESS | 0x00000000 | |
| 09:18:07,014 | 1640 | NtQueryInformationFile |
FileHandle => 0x000002a4 FileInformation => @\x00\x00\x00\x00\x00\x00\x00>\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:18:07,014 | 1640 | NtReadFile |
Buffer => [.ShellClassInfo]
LocalizedResourceName=@shell32.dll,-21785
FileHandle => 0x000002a4 |
SUCCESS | 0x00000000 | |
| 09:18:07,014 | 1640 | NtFreeVirtualMemory |
FreeType => 0x00008000 ProcessHandle => 0xffffffff RegionSize => 0x00101000 BaseAddress => 0x01fc0000 |
SUCCESS | 0x00000000 | |
| 09:18:07,014 | 1640 | RegCreateKeyExW |
Handle => 0x000002a4 Access => 33554432 Registry => 0x80000001 Class => SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders |
SUCCESS | 0x00000000 | |
| 09:18:07,014 | 1640 | RegQueryValueExW |
Handle => 0x000002a4 Data => %\x00U\x00S\x00E\x00R\x00P\x00R\x00O\x00F\x00I\x00L\x00E\x00%\x00\\x00D\x00e\x00s\x00k\x00t\x00o\x00p\x00\x00\x00 ValueName => Desktop |
SUCCESS | 0x00000000 | |
| 09:18:07,014 | 1640 | RegCloseKey |
Handle => 0x000002a4 |
SUCCESS | 0x00000000 | |
| 09:18:07,014 | 1640 | RegCreateKeyExW |
Handle => 0x000002a4 Access => 33554432 Registry => 0x80000001 Class => SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders |
SUCCESS | 0x00000000 | |
| 09:18:07,014 | 1640 | RegSetValueExW |
Handle => 0x000002a4 Buffer => C\x00:\x00\\x00D\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00s\x00 \x00a\x00n\x00d\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00D\x00W\x00\\x00D\x00e\x00s\x00k\x00t\x00o\x00p\x00\x00\x00 ValueName => Desktop Type => 1 |
SUCCESS | 0x00000000 | |
| 09:18:07,014 | 1640 | RegCloseKey |
Handle => 0x000002a4 |
SUCCESS | 0x00000000 | |
| 09:18:07,014 | 1640 | RegOpenKeyExW |
Handle => 0x000002a4 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume |
SUCCESS | 0x00000000 | |
| 09:18:07,014 | 1640 | RegOpenKeyExW |
Handle => 0x000002a8 Registry => 0x000002a4 SubKey => {e6c716a2-b561-11e1-9849-806d6172696f}\ |
SUCCESS | 0x00000000 | |
| 09:18:07,014 | 1640 | RegCloseKey |
Handle => 0x000002a4 |
SUCCESS | 0x00000000 | |
| 09:18:07,014 | 1640 | RegQueryValueExW |
Handle => 0x000002a8 Data => 1 ValueName => Generation |
SUCCESS | 0x00000000 | |
| 09:18:07,014 | 1640 | RegCloseKey |
Handle => 0x000002a8 |
SUCCESS | 0x00000000 | |
| 09:18:07,024 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings |
SUCCESS | 0x002432f8 | |
| 09:18:07,024 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002432f8 | |
| 09:18:07,024 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Desktop |
SUCCESS | 0x002432f8 | |
| 09:18:07,024 | 1640 | RegCreateKeyExW |
Handle => 0x000002a8 Access => 33554432 Registry => 0x80000002 Class => SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders |
SUCCESS | 0x00000000 | |
| 09:18:07,024 | 1640 | RegQueryValueExW |
Handle => 0x000002a8 Data => %\x00A\x00L\x00L\x00U\x00S\x00E\x00R\x00S\x00P\x00R\x00O\x00F\x00I\x00L\x00E\x00%\x00\\x00D\x00e\x00s\x00k\x00t\x00o\x00p\x00\x00\x00 ValueName => Common Desktop |
SUCCESS | 0x00000000 | |
| 09:18:07,024 | 1640 | RegCloseKey |
Handle => 0x000002a8 |
SUCCESS | 0x00000000 | |
| 09:18:07,024 | 1640 | RegCreateKeyExW |
Handle => 0x000002a8 Access => 33554432 Registry => 0x80000002 Class => SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders |
SUCCESS | 0x00000000 | |
| 09:18:07,024 | 1640 | RegSetValueExW |
Handle => 0x000002a8 Buffer => C\x00:\x00\\x00D\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00s\x00 \x00a\x00n\x00d\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00A\x00l\x00l\x00 \x00U\x00s\x00e\x00r\x00s\x00\\x00D\x00e\x00s\x00k\x00t\x00o\x00p\x00\x00\x00 ValueName => Common Desktop Type => 1 |
SUCCESS | 0x00000000 | |
| 09:18:07,024 | 1640 | RegCloseKey |
Handle => 0x000002a8 |
SUCCESS | 0x00000000 | |
| 09:18:07,024 | 1640 | RegOpenKeyExW |
Handle => 0x000002a8 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume |
SUCCESS | 0x00000000 | |
| 09:18:07,024 | 1640 | RegOpenKeyExW |
Handle => 0x000002a4 Registry => 0x000002a8 SubKey => {e6c716a2-b561-11e1-9849-806d6172696f}\ |
SUCCESS | 0x00000000 | |
| 09:18:07,024 | 1640 | RegCloseKey |
Handle => 0x000002a8 |
SUCCESS | 0x00000000 | |
| 09:18:07,024 | 1640 | RegQueryValueExW |
Handle => 0x000002a4 Data => 1 ValueName => Generation |
SUCCESS | 0x00000000 | |
| 09:18:07,024 | 1640 | RegCloseKey |
Handle => 0x000002a4 |
SUCCESS | 0x00000000 | |
| 09:18:07,024 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings |
SUCCESS | 0x00243368 | |
| 09:18:07,024 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\All Users |
SUCCESS | 0x00243368 | |
| 09:18:07,024 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\All Users\Desktop |
SUCCESS | 0x00243368 | |
| 09:18:07,024 | 1640 | RegOpenKeyExW |
Handle => 0x000002a4 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks |
SUCCESS | 0x00000000 | |
| 09:18:07,024 | 1640 | RegEnumValueW |
Index => 0 Handle => 0x000002a4 DataLength => 0 ValueName => {AEB6717E-7E19-11d0-97EE-00C04FD91972} Type => 1 |
SUCCESS | 0x00000000 | |
| 09:18:07,024 | 1640 | RegOpenKeyExW |
Handle => 0x000002aa Registry => 0x80000000 SubKey => CLSID\{AEB6717E-7E19-11D0-97EE-00C04FD91972}\InProcServer32 |
SUCCESS | 0x00000000 | |
| 09:18:07,024 | 1640 | RegQueryValueExW |
Handle => 0x000002aa Data => s\x00h\x00e\x00l\x00l\x003\x002\x00.\x00d\x00l\x00l\x00\x00\x00 ValueName => |
SUCCESS | 0x00000000 | |
| 09:18:07,024 | 1640 | RegQueryValueExW |
Handle => 0x000002aa DataLength => 0 ValueName => LoadWithoutCOM Type => 0 |
FAILURE | 0x00000002 | |
| 09:18:07,024 | 1640 | RegCloseKey |
Handle => 0x000002aa |
SUCCESS | 0x00000000 | |
| 09:18:07,024 | 1640 | RegEnumValueW |
Index => 1 Handle => 0x000002a4 DataLength => 0 ValueName => {AEB6717E-7E19-11d0-97EE-00C04FD91972} Type => 33290996 |
FAILURE | 0x00000103 | |
| 09:18:07,024 | 1640 | RegCloseKey |
Handle => 0x000002a4 |
SUCCESS | 0x00000000 | |
| 09:18:07,024 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Associations |
FAILURE | 0x00000002 | |
| 09:18:07,024 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Associations |
FAILURE | 0x00000002 | |
| 09:18:07,024 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Associations |
FAILURE | 0x00000002 | |
| 09:18:07,024 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Associations |
FAILURE | 0x00000002 | |
| 09:18:07,024 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Associations |
FAILURE | 0x00000002 | |
| 09:18:07,024 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Associations |
FAILURE | 0x00000002 | |
| 09:18:07,024 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Associations |
FAILURE | 0x00000002 | |
| 09:18:07,024 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Associations |
FAILURE | 0x00000002 | |
| 09:18:07,024 | 1640 | RegOpenKeyExW |
Handle => 0x000002a6 Registry => 0x80000000 SubKey => .exe |
SUCCESS | 0x00000000 | |
| 09:18:07,024 | 1640 | RegQueryValueExW |
Handle => 0x000002a6 Data => e\x00x\x00e\x00f\x00i\x00l\x00e\x00\x00\x00 ValueName => |
SUCCESS | 0x00000000 | |
| 09:18:07,024 | 1640 | RegCloseKey |
Handle => 0x000002a6 |
SUCCESS | 0x00000000 | |
| 09:18:07,024 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000000 SubKey => .ade |
FAILURE | 0x00000002 | |
| 09:18:07,024 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000000 SubKey => .adp |
FAILURE | 0x00000002 | |
| 09:18:07,024 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000000 SubKey => .app |
FAILURE | 0x00000002 | |
| 09:18:07,024 | 1640 | RegOpenKeyExW |
Handle => 0x000002a6 Registry => 0x80000000 SubKey => .asp |
SUCCESS | 0x00000000 | |
| 09:18:07,024 | 1640 | RegQueryValueExW |
Handle => 0x000002a6 Data => a\x00s\x00p\x00f\x00i\x00l\x00e\x00\x00\x00 ValueName => |
SUCCESS | 0x00000000 | |
| 09:18:07,024 | 1640 | RegCloseKey |
Handle => 0x000002a6 |
SUCCESS | 0x00000000 | |
| 09:18:07,024 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000000 SubKey => .bas |
FAILURE | 0x00000002 | |
| 09:18:07,024 | 1640 | RegOpenKeyExW |
Handle => 0x000002a6 Registry => 0x80000000 SubKey => .bat |
SUCCESS | 0x00000000 | |
| 09:18:07,024 | 1640 | RegQueryValueExW |
Handle => 0x000002a6 Data => b\x00a\x00t\x00f\x00i\x00l\x00e\x00\x00\x00 ValueName => |
SUCCESS | 0x00000000 | |
| 09:18:07,024 | 1640 | RegCloseKey |
Handle => 0x000002a6 |
SUCCESS | 0x00000000 | |
| 09:18:07,024 | 1640 | RegOpenKeyExW |
Handle => 0x000002a6 Registry => 0x80000000 SubKey => .cer |
SUCCESS | 0x00000000 | |
| 09:18:07,024 | 1640 | RegQueryValueExW |
Handle => 0x000002a6 Data => C\x00E\x00R\x00F\x00i\x00l\x00e\x00\x00\x00 ValueName => |
SUCCESS | 0x00000000 | |
| 09:18:07,024 | 1640 | RegCloseKey |
Handle => 0x000002a6 |
SUCCESS | 0x00000000 | |
| 09:18:07,024 | 1640 | RegOpenKeyExW |
Handle => 0x000002a6 Registry => 0x80000000 SubKey => .chm |
SUCCESS | 0x00000000 | |
| 09:18:07,024 | 1640 | RegQueryValueExW |
Handle => 0x000002a6 Data => c\x00h\x00m\x00.\x00f\x00i\x00l\x00e\x00\x00\x00 ValueName => |
SUCCESS | 0x00000000 | |
| 09:18:07,024 | 1640 | RegCloseKey |
Handle => 0x000002a6 |
SUCCESS | 0x00000000 | |
| 09:18:07,024 | 1640 | RegOpenKeyExW |
Handle => 0x000002a6 Registry => 0x80000000 SubKey => .cmd |
SUCCESS | 0x00000000 | |
| 09:18:07,024 | 1640 | RegQueryValueExW |
Handle => 0x000002a6 Data => c\x00m\x00d\x00f\x00i\x00l\x00e\x00\x00\x00 ValueName => |
SUCCESS | 0x00000000 | |
| 09:18:07,024 | 1640 | RegCloseKey |
Handle => 0x000002a6 |
SUCCESS | 0x00000000 | |
| 09:18:07,024 | 1640 | RegOpenKeyExW |
Handle => 0x000002a6 Registry => 0x80000000 SubKey => .com |
SUCCESS | 0x00000000 | |
| 09:18:07,034 | 1640 | RegQueryValueExW |
Handle => 0x000002a6 Data => c\x00o\x00m\x00f\x00i\x00l\x00e\x00\x00\x00 ValueName => |
SUCCESS | 0x00000000 | |
| 09:18:07,034 | 1640 | RegCloseKey |
Handle => 0x000002a6 |
SUCCESS | 0x00000000 | |
| 09:18:07,034 | 1640 | RegOpenKeyExW |
Handle => 0x000002a6 Registry => 0x80000000 SubKey => .cpl |
SUCCESS | 0x00000000 | |
| 09:18:07,034 | 1640 | RegQueryValueExW |
Handle => 0x000002a6 Data => c\x00p\x00l\x00f\x00i\x00l\x00e\x00\x00\x00 ValueName => |
SUCCESS | 0x00000000 | |
| 09:18:07,034 | 1640 | RegCloseKey |
Handle => 0x000002a6 |
SUCCESS | 0x00000000 | |
| 09:18:07,034 | 1640 | RegOpenKeyExW |
Handle => 0x000002a6 Registry => 0x80000000 SubKey => .crt |
SUCCESS | 0x00000000 | |
| 09:18:07,034 | 1640 | RegQueryValueExW |
Handle => 0x000002a6 Data => C\x00E\x00R\x00F\x00i\x00l\x00e\x00\x00\x00 ValueName => |
SUCCESS | 0x00000000 | |
| 09:18:07,034 | 1640 | RegCloseKey |
Handle => 0x000002a6 |
SUCCESS | 0x00000000 | |
| 09:18:07,034 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000000 SubKey => .csh |
FAILURE | 0x00000002 | |
| 09:18:07,034 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CoGetClassObject FunctionAddress => 0x775156c5 ModuleHandle => 0x774e0000 |
SUCCESS | 0x00000000 | |
| 09:18:07,034 | 1640 | RegOpenKeyExW |
Handle => 0x000002a4 Registry => 0x80000002 SubKey => Software\Microsoft\COM3 |
SUCCESS | 0x00000000 | |
| 09:18:07,034 | 1640 | RegQueryValueExW |
Handle => 0x000002a4 Data => 1 ValueName => Com+Enabled |
SUCCESS | 0x00000000 | |
| 09:18:07,034 | 1640 | RegCloseKey |
Handle => 0x000002a4 |
SUCCESS | 0x00000000 | |
| 09:18:07,034 | 1640 | LdrLoadDll |
Flags => 33290296 BaseAddress => 0x76fd0000 FileName => CLBCATQ.DLL |
SUCCESS | 0x00000000 | |
| 09:18:07,034 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetCatalogObject FunctionAddress => 0x76fd3f78 ModuleHandle => 0x76fd0000 |
SUCCESS | 0x00000000 | |
| 09:18:07,034 | 1640 | RegOpenKeyExW |
Handle => 0x000002a4 Registry => 0x80000002 SubKey => Software\Microsoft\COM3 |
SUCCESS | 0x00000000 | |
| 09:18:07,034 | 1640 | RegQueryValueExW |
Handle => 0x000002a4 Data => 1 ValueName => Com+Enabled |
SUCCESS | 0x00000000 | |
| 09:18:07,044 | 1640 | RegCloseKey |
Handle => 0x000002a4 |
SUCCESS | 0x00000000 | |
| 09:18:07,044 | 1640 | LdrLoadDll |
Flags => 33290296 BaseAddress => 0x76fd0000 FileName => CLBCATQ.DLL |
SUCCESS | 0x00000000 | |
| 09:18:07,044 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetCatalogObject2 FunctionAddress => 0x76fd4017 ModuleHandle => 0x76fd0000 |
SUCCESS | 0x00000000 | |
| 09:18:07,044 | 1640 | LdrGetDllHandle |
ModuleHandle => 0x774e0000 FileName => ole32.dll |
SUCCESS | 0x00000000 | |
| 09:18:07,044 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CLSIDFromOle1Class FunctionAddress => 0x775188b9 ModuleHandle => 0x774e0000 |
SUCCESS | 0x00000000 | |
| 09:18:07,044 | 1640 | NtOpenKey |
DesiredAccess => 33554432 KeyHandle => 0x000002a8 ObjectAttributes => \Registry\User\S-1-5-21-1935655697-1606980848-1060284298-1003_Classes |
SUCCESS | 0x00000000 | |
| 09:18:07,044 | 1640 | RegOpenKeyExW |
Handle => 0x000002a4 Registry => 0x80000002 SubKey => Software\Classes |
SUCCESS | 0x00000000 | |
| 09:18:07,044 | 1640 | RegOpenKeyExW |
Handle => 0x000002b0 Registry => 0x80000002 SubKey => Software\Microsoft\COM3 |
SUCCESS | 0x00000000 | |
| 09:18:07,044 | 1640 | NtOpenKey |
DesiredAccess => 16 KeyHandle => 0x000002b8 ObjectAttributes => \REGISTRY\USER |
SUCCESS | 0x00000000 | |
| 09:18:07,044 | 1640 | RegOpenKeyExW |
Handle => 0x000002c0 Registry => 0x80000002 SubKey => Software\Classes |
SUCCESS | 0x00000000 | |
| 09:18:07,044 | 1640 | NtOpenKey |
DesiredAccess => 16 KeyHandle => 0x000002c8 ObjectAttributes => \REGISTRY\USER |
SUCCESS | 0x00000000 | |
| 09:18:07,044 | 1640 | RegOpenKeyExW |
Handle => 0x000002d0 Registry => 0x80000002 SubKey => Software\Microsoft\COM3 |
SUCCESS | 0x00000000 | |
| 09:18:07,044 | 1640 | RegOpenKeyExW |
Handle => 0x000002d8 Registry => 0x80000002 SubKey => Software\Microsoft\COM3 |
SUCCESS | 0x00000000 | |
| 09:18:07,044 | 1640 | RegOpenKeyExW |
Handle => 0x000002e0 Registry => 0x80000002 SubKey => Software\Classes\CLSID |
SUCCESS | 0x00000000 | |
| 09:18:07,044 | 1640 | RegOpenKeyExW |
Handle => 0x000002e8 Registry => 0x80000002 SubKey => Software\Classes |
SUCCESS | 0x00000000 | |
| 09:18:07,044 | 1640 | RegOpenKeyExW |
Handle => 0x000002f0 Registry => 0x80000002 SubKey => Software\Microsoft\COM3 |
SUCCESS | 0x00000000 | |
| 09:18:07,044 | 1640 | NtOpenKey |
DesiredAccess => 16 KeyHandle => 0x000002f8 ObjectAttributes => \REGISTRY\USER |
SUCCESS | 0x00000000 | |
| 09:18:07,044 | 1640 | RegOpenKeyExW |
Handle => 0x00000300 Registry => 0x80000002 SubKey => Software\Microsoft\COM3 |
SUCCESS | 0x00000000 | |
| 09:18:07,044 | 1640 | RegOpenKeyExW |
Handle => 0x00000308 Registry => 0x80000002 SubKey => Software\Microsoft\COM3 |
SUCCESS | 0x00000000 | |
| 09:18:07,044 | 1640 | RegOpenKeyExW |
Handle => 0x00000310 Registry => 0x80000002 SubKey => Software\Classes\CLSID |
SUCCESS | 0x00000000 | |
| 09:18:07,044 | 1640 | RegOpenKeyExW |
Handle => 0x00000318 Registry => 0x80000002 SubKey => Software\Microsoft\COM3 |
SUCCESS | 0x00000000 | |
| 09:18:07,044 | 1640 | RegQueryValueExW |
Handle => 0x00000318 Data => ValueName => REGDBVersion |
SUCCESS | 0x00000000 | |
| 09:18:07,044 | 1640 | RegCloseKey |
Handle => 0x00000318 |
SUCCESS | 0x00000000 | |
| 09:18:07,044 | 1640 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => KERNEL32.DLL |
SUCCESS | 0x00000000 | |
| 09:18:07,044 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => InitializeCriticalSectionAndSpinCount FunctionAddress => 0x7c80b8b9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:18:07,044 | 1640 | NtCreateFile |
ShareAccess => 1 FileName => C:\WINDOWS\Registration\R000000000007.clb DesiredAccess => 0x80100080 CreateDisposition => 1 FileHandle => 0x00000318 |
SUCCESS | 0x00000000 | |
| 09:18:07,044 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000318 FileInformation => \x00`\x00\x00\x00\x00\x00\x00\xf0W\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:18:07,044 | 1640 | NtSetInformationFile |
FileHandle => 0x00000318 FileInformation => |
SUCCESS | 0x00000000 | 1 time |
| 09:18:07,044 | 1640 | NtReadFile |
Buffer => COM+\x01\x00\x00\x00\x01\x00\x12\x00$\x00\x00\x00\x00\x01\x01\x00c\x00\x00\x00\x00\x00\x00\x01\x01\x00\x00\x00\x00\x01\x10\x00\x00\x00\x00\x00\xc0\x00\x00\x00\x00\x00\x00F\x0e\x00\x00\x000\x01\x00\x00\xa0\x03\x00\x003_0\x00\xd0\x04\x00\x00\x0c\x00\x00\x003_1\x00\xdc\x04\x00\x00\x88\x02\x00\x003_2\x00d\x07\x00\x00<\x00\x00\x003_3\x00\xa0\x07\x00\x00\x90\x08\x00\x003_4\x000\x10\x00\x00(\x00\x00\x003_5\x00X\x10\x00\x00(\x00\x00\x003_6\x00\x80\x10\x00\x00(\x00\x00\x003_7\x00\xa8\x10\x00\x00\x88\x10\x00\x003_8\x000!\x00\x00\xa8 \x00\x003_9\x00\xd8*\x00\x00<\x04\x00\x003_10\x00\x00\x00\x00\x14/\x00\x00\x0c\x01\x00\x003_11\x00\x00\x00\x00 0\x00\x00\x1c\x00\x00\x003_12\x00\x00\x00\x00<0\x00\x00\x14\x00\x00\x003_16\x00\x00\x00\x00P0\x00\x00\x90\x0e\x00\x00#Schema\x00\xe0>\x00\x00 FileHandle => 0x00000318 |
SUCCESS | 0x00000000 | |
| 09:18:07,054 | 1640 | RegOpenKeyExW |
Handle => 0x00000318 Registry => 0x80000002 SubKey => Software\Microsoft\COM3 |
SUCCESS | 0x00000000 | |
| 09:18:07,054 | 1640 | RegQueryValueExW |
Handle => 0x00000318 Data => ValueName => REGDBVersion |
SUCCESS | 0x00000000 | |
| 09:18:07,054 | 1640 | RegCloseKey |
Handle => 0x00000318 |
SUCCESS | 0x00000000 | |
| 09:18:07,054 | 1640 | RegOpenKeyExW |
Handle => 0x0000031a Registry => 0x000002aa SubKey => CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4} |
SUCCESS | 0x00000000 | |
| 09:18:07,054 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x0000031a SubKey => TreatAs |
FAILURE | 0x00000002 | |
| 09:18:07,054 | 1640 | RegOpenKeyExW |
Handle => 0x0000031e Registry => 0x000002aa SubKey => |
SUCCESS | 0x00000000 | |
| 09:18:07,054 | 1640 | RegCloseKey |
Handle => 0x0000031a |
SUCCESS | 0x00000000 | |
| 09:18:07,054 | 1640 | RegOpenKeyExW |
Handle => 0x0000031a Registry => 0x0000031e SubKey => CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4} |
SUCCESS | 0x00000000 | |
| 09:18:07,054 | 1640 | RegOpenKeyExW |
Handle => 0x00000322 Registry => 0x0000031a SubKey => InprocServer32 |
SUCCESS | 0x00000000 | |
| 09:18:07,054 | 1640 | RegQueryValueExW |
Handle => 0x00000322 DataLength => 1000 ValueName => InprocServer32 Type => 33357920 |
FAILURE | 0x00000002 | |
| 09:18:07,054 | 1640 | RegCloseKey |
Handle => 0x00000322 |
SUCCESS | 0x00000000 | |
| 09:18:07,054 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x0000031a SubKey => InprocServerX86 |
FAILURE | 0x00000002 | |
| 09:18:07,054 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x0000031a SubKey => LocalServer32 |
FAILURE | 0x00000002 | |
| 09:18:07,054 | 1640 | RegOpenKeyExW |
Handle => 0x00000322 Registry => 0x0000031a SubKey => InprocServer32 |
SUCCESS | 0x00000000 | |
| 09:18:07,054 | 1640 | RegQueryValueExW |
Handle => 0x00000322 Data => C\x00:\x00\\x00W\x00I\x00N\x00D\x00O\x00W\x00S\x00\\x00s\x00y\x00s\x00t\x00e\x00m\x003\x002\x00\\x00u\x00r\x00l\x00m\x00o\x00n\x00.\x00d\x00l\x00l\x00\x00\x00 ValueName => |
SUCCESS | 0x00000000 | |
| 09:18:07,054 | 1640 | RegCloseKey |
Handle => 0x00000322 |
SUCCESS | 0x00000000 | |
| 09:18:07,054 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x0000031a SubKey => InprocHandler32 |
FAILURE | 0x00000002 | |
| 09:18:07,054 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x0000031a SubKey => InprocHandlerX86 |
FAILURE | 0x00000002 | |
| 09:18:07,054 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x0000031a SubKey => LocalServer32 |
FAILURE | 0x00000002 | |
| 09:18:07,054 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x0000031a SubKey => LocalServer |
FAILURE | 0x00000002 | |
| 09:18:07,054 | 1640 | RegOpenKeyExW |
Handle => 0x00000322 Registry => 0x0000031e SubKey => CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4} |
SUCCESS | 0x00000000 | |
| 09:18:07,054 | 1640 | RegQueryValueExW |
Handle => 0x00000322 DataLength => 100 ValueName => AppID Type => 33290088 |
FAILURE | 0x00000002 | |
| 09:18:07,054 | 1640 | RegCloseKey |
Handle => 0x00000322 |
SUCCESS | 0x00000000 | |
| 09:18:07,054 | 1640 | RegCloseKey |
Handle => 0x0000031a |
SUCCESS | 0x00000000 | |
| 09:18:07,054 | 1640 | RegOpenKeyExW |
Handle => 0x0000031a Registry => 0x0000031e SubKey => CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4} |
SUCCESS | 0x00000000 | |
| 09:18:07,054 | 1640 | RegOpenKeyExW |
Handle => 0x00000322 Registry => 0x0000031a SubKey => InprocServer32 |
SUCCESS | 0x00000000 | |
| 09:18:07,054 | 1640 | RegQueryValueExW |
Handle => 0x00000322 Data => B\x00o\x00t\x00h\x00\x00\x00 ValueName => ThreadingModel |
SUCCESS | 0x00000000 | |
| 09:18:07,054 | 1640 | RegCloseKey |
Handle => 0x00000322 |
SUCCESS | 0x00000000 | |
| 09:18:07,054 | 1640 | RegCloseKey |
Handle => 0x0000031a |
SUCCESS | 0x00000000 | |
| 09:18:07,054 | 1640 | RegOpenKeyExW |
Handle => 0x0000031a Registry => 0x80000000 SubKey => CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4} |
SUCCESS | 0x00000000 | |
| 09:18:07,054 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x0000031a SubKey => TreatAs |
FAILURE | 0x00000002 | |
| 09:18:07,054 | 1640 | RegCloseKey |
Handle => 0x0000031a |
SUCCESS | 0x00000000 | |
| 09:18:07,084 | 1640 | LdrLoadDll |
Flags => 33286968 BaseAddress => 0x7e1e0000 FileName => C:\WINDOWS\system32\urlmon.dll |
SUCCESS | 0x00000000 | |
| 09:18:07,084 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => DllGetClassObject FunctionAddress => 0x7e1e603a ModuleHandle => 0x7e1e0000 |
SUCCESS | 0x00000000 | |
| 09:18:07,084 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => DllCanUnloadNow FunctionAddress => 0x7e1e2eec ModuleHandle => 0x7e1e0000 |
SUCCESS | 0x00000000 | |
| 09:18:07,084 | 1640 | RegOpenKeyExA |
Handle => 0x0000032a Registry => 0x80000000 SubKey => CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\InProcServer32 |
SUCCESS | 0x00000000 | |
| 09:18:07,084 | 1640 | RegQueryValueExW |
Handle => 0x0000032a Data => C\x00:\x00\\x00W\x00I\x00N\x00D\x00O\x00W\x00S\x00\\x00s\x00y\x00s\x00t\x00e\x00m\x003\x002\x00\\x00u\x00r\x00l\x00m\x00o\x00n\x00.\x00d\x00l\x00l\x00\x00\x00 ValueName => |
SUCCESS | 0x00000000 | |
| 09:18:07,084 | 1640 | LdrLoadDll |
Flags => 33289640 BaseAddress => 0x7e1e0000 FileName => C:\WINDOWS\system32\urlmon.dll |
SUCCESS | 0x00000000 | |
| 09:18:07,084 | 1640 | RegCloseKey |
Handle => 0x0000032a |
SUCCESS | 0x00000000 | |
| 09:18:07,084 | 1640 | RegOpenKeyExA |
Handle => 0x00000328 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ |
SUCCESS | 0x00000000 | |
| 09:18:07,084 | 1640 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ |
FAILURE | 0x00000002 | |
| 09:18:07,084 | 1640 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ |
FAILURE | 0x00000002 | |
| 09:18:07,084 | 1640 | RegOpenKeyExA |
Handle => 0x00000330 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ |
SUCCESS | 0x00000000 | |
| 09:18:07,084 | 1640 | RegOpenKeyExA |
Handle => 0x00000334 Registry => 0x00000330 SubKey => Ranges\ |
SUCCESS | 0x00000000 | |
| 09:18:07,084 | 1640 | RegQueryInfoKeyW |
MaxClassLength => 0 MaxValueLength => 0 MaxValueNameLength => 0 ValueCount => 0 MaxSubKeyLength => 0 KeyHandle => 0x00000334 SubKeyCount => 0 Class => |
SUCCESS | 0x00000000 | |
| 09:18:07,084 | 1640 | RegCloseKey |
Handle => 0x00000334 |
SUCCESS | 0x00000000 | |
| 09:18:07,084 | 1640 | NtCreateSection |
ObjectAttributes => C:\ntdll DesiredAccess => 0x000f0007 SectionHandle => 0x00000334 FileHandle => 0x00000000 |
SUCCESS | 0x40000000 | |
| 09:18:07,084 | 1640 | ZwMapViewOfSection |
SectionOffset => 0x01fbf5f8 SectionHandle => 0x00000334 ProcessHandle => 0xffffffff BaseAddress => 0x020e0000 |
SUCCESS | 0x00000000 | |
| 09:18:07,184 | 1640 | RegOpenKeyExW |
Handle => 0x00000338 Registry => 0x80000002 SubKey => System\Setup |
SUCCESS | 0x00000000 | |
| 09:18:07,184 | 1640 | RegQueryValueExW |
Handle => 0x00000338 Data => 0 ValueName => SystemSetupInProgress |
SUCCESS | 0x00000000 | |
| 09:18:07,184 | 1640 | RegCloseKey |
Handle => 0x00000338 |
SUCCESS | 0x00000000 | |
| 09:18:07,184 | 1640 | RegOpenKeyExW |
Handle => 0x00000338 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\ |
SUCCESS | 0x00000000 | |
| 09:18:07,194 | 1640 | RegOpenKeyExW |
Handle => 0x0000033c Registry => 0x00000338 SubKey => 0 |
SUCCESS | 0x00000000 | |
| 09:18:07,194 | 1640 | RegCloseKey |
Handle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:18:07,194 | 1640 | RegOpenKeyExW |
Handle => 0x0000033c Registry => 0x00000338 SubKey => 1 |
SUCCESS | 0x00000000 | |
| 09:18:07,194 | 1640 | RegCloseKey |
Handle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:18:07,194 | 1640 | RegOpenKeyExW |
Handle => 0x0000033c Registry => 0x00000338 SubKey => 2 |
SUCCESS | 0x00000000 | |
| 09:18:07,194 | 1640 | RegCloseKey |
Handle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:18:07,194 | 1640 | RegOpenKeyExW |
Handle => 0x0000033c Registry => 0x00000338 SubKey => 3 |
SUCCESS | 0x00000000 | |
| 09:18:07,194 | 1640 | RegCloseKey |
Handle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:18:07,194 | 1640 | RegOpenKeyExW |
Handle => 0x0000033c Registry => 0x00000338 SubKey => 4 |
SUCCESS | 0x00000000 | |
| 09:18:07,194 | 1640 | RegCloseKey |
Handle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:18:07,194 | 1640 | RegCloseKey |
Handle => 0x00000338 |
SUCCESS | 0x00000000 | |
| 09:18:07,194 | 1640 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\ |
FAILURE | 0x00000002 | |
| 09:18:07,194 | 1640 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\ |
FAILURE | 0x00000002 | |
| 09:18:07,194 | 1640 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\ |
FAILURE | 0x00000002 | |
| 09:18:07,194 | 1640 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\ |
FAILURE | 0x00000002 | |
| 09:18:07,194 | 1640 | RegOpenKeyExA |
Handle => 0x00000338 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\ |
SUCCESS | 0x00000000 | |
| 09:18:07,194 | 1640 | RegEnumKeyExW |
Index => 0 Handle => 0x00000338 Name => 0 Class => |
SUCCESS | 0x00000000 | |
| 09:18:07,194 | 1640 | RegOpenKeyExA |
Handle => 0x0000033c Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0 |
SUCCESS | 0x00000000 | |
| 09:18:07,194 | 1640 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0 |
FAILURE | 0x00000002 | |
| 09:18:07,194 | 1640 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0 |
FAILURE | 0x00000002 | |
| 09:18:07,194 | 1640 | RegOpenKeyExA |
Handle => 0x00000340 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0 |
SUCCESS | 0x00000000 | |
| 09:18:07,194 | 1640 | RegQueryValueExW |
Handle => 0x00000340 Data => 33 ValueName => Flags |
SUCCESS | 0x00000000 | |
| 09:18:07,194 | 1640 | RegCloseKey |
Handle => 0x00000340 |
SUCCESS | 0x00000000 | |
| 09:18:07,194 | 1640 | RegCloseKey |
Handle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:18:07,194 | 1640 | RegEnumKeyExW |
Index => 1 Handle => 0x00000338 Name => 1 Class => |
SUCCESS | 0x00000000 | |
| 09:18:07,194 | 1640 | RegOpenKeyExA |
Handle => 0x0000033c Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1 |
SUCCESS | 0x00000000 | |
| 09:18:07,194 | 1640 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1 |
FAILURE | 0x00000002 | |
| 09:18:07,194 | 1640 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1 |
FAILURE | 0x00000002 | |
| 09:18:07,194 | 1640 | RegOpenKeyExA |
Handle => 0x00000340 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1 |
SUCCESS | 0x00000000 | |
| 09:18:07,194 | 1640 | RegQueryValueExW |
Handle => 0x00000340 Data => 219 ValueName => Flags |
SUCCESS | 0x00000000 | |
| 09:18:07,194 | 1640 | RegOpenKeyExA |
Handle => 0x00000344 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ |
SUCCESS | 0x00000000 | |
| 09:18:07,194 | 1640 | RegSetValueExW |
Handle => 0x00000344 Buffer => 1 ValueName => ProxyBypass Type => 4 |
SUCCESS | 0x00000000 | |
| 09:18:07,194 | 1640 | RegSetValueExW |
Handle => 0x00000344 Buffer => 1 ValueName => IntranetName Type => 4 |
SUCCESS | 0x00000000 | |
| 09:18:07,194 | 1640 | RegSetValueExW |
Handle => 0x00000344 Buffer => 1 ValueName => UNCAsIntranet Type => 4 |
SUCCESS | 0x00000000 | |
| 09:18:07,194 | 1640 | RegCloseKey |
Handle => 0x00000344 |
SUCCESS | 0x00000000 | |
| 09:18:07,194 | 1640 | RegCloseKey |
Handle => 0x00000340 |
SUCCESS | 0x00000000 | |
| 09:18:07,194 | 1640 | RegCloseKey |
Handle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:18:07,194 | 1640 | RegEnumKeyExW |
Index => 2 Handle => 0x00000338 Name => 2 Class => |
SUCCESS | 0x00000000 | |
| 09:18:07,194 | 1640 | RegOpenKeyExA |
Handle => 0x0000033c Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2 |
SUCCESS | 0x00000000 | |
| 09:18:07,194 | 1640 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2 |
FAILURE | 0x00000002 | |
| 09:18:07,194 | 1640 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2 |
FAILURE | 0x00000002 | |
| 09:18:07,194 | 1640 | RegOpenKeyExA |
Handle => 0x00000340 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2 |
SUCCESS | 0x00000000 | |
| 09:18:07,194 | 1640 | RegQueryValueExW |
Handle => 0x00000340 Data => 71 ValueName => Flags |
SUCCESS | 0x00000000 | |
| 09:18:07,194 | 1640 | RegCloseKey |
Handle => 0x00000340 |
SUCCESS | 0x00000000 | |
| 09:18:07,194 | 1640 | RegCloseKey |
Handle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:18:07,194 | 1640 | RegEnumKeyExW |
Index => 3 Handle => 0x00000338 Name => 3 Class => |
SUCCESS | 0x00000000 | |
| 09:18:07,194 | 1640 | RegOpenKeyExA |
Handle => 0x0000033c Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 |
SUCCESS | 0x00000000 | |
| 09:18:07,194 | 1640 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 |
FAILURE | 0x00000002 | |
| 09:18:07,194 | 1640 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 |
FAILURE | 0x00000002 | |
| 09:18:07,194 | 1640 | RegOpenKeyExA |
Handle => 0x00000340 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 |
SUCCESS | 0x00000000 | |
| 09:18:07,194 | 1640 | RegQueryValueExW |
Handle => 0x00000340 Data => 1 ValueName => Flags |
SUCCESS | 0x00000000 | |
| 09:18:07,194 | 1640 | RegCloseKey |
Handle => 0x00000340 |
SUCCESS | 0x00000000 | |
| 09:18:07,194 | 1640 | RegCloseKey |
Handle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:18:07,194 | 1640 | RegEnumKeyExW |
Index => 4 Handle => 0x00000338 Name => 4 Class => |
SUCCESS | 0x00000000 | |
| 09:18:07,194 | 1640 | RegOpenKeyExA |
Handle => 0x0000033c Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 |
SUCCESS | 0x00000000 | |
| 09:18:07,194 | 1640 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 |
FAILURE | 0x00000002 | |
| 09:18:07,194 | 1640 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 |
FAILURE | 0x00000002 | |
| 09:18:07,194 | 1640 | RegOpenKeyExA |
Handle => 0x00000340 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 |
SUCCESS | 0x00000000 | |
| 09:18:07,194 | 1640 | RegQueryValueExW |
Handle => 0x00000340 Data => 3 ValueName => Flags |
SUCCESS | 0x00000000 | |
| 09:18:07,194 | 1640 | RegCloseKey |
Handle => 0x00000340 |
SUCCESS | 0x00000000 | |
| 09:18:07,194 | 1640 | RegCloseKey |
Handle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:18:07,194 | 1640 | RegEnumKeyExW |
Index => 5 Handle => 0x00000338 Name => 4 Class => |
FAILURE | 0x00000103 | |
| 09:18:07,194 | 1640 | RegCloseKey |
Handle => 0x00000338 |
SUCCESS | 0x00000000 | |
| 09:18:07,194 | 1640 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\ |
FAILURE | 0x00000002 | |
| 09:18:07,194 | 1640 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\ |
FAILURE | 0x00000002 | |
| 09:18:07,194 | 1640 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\ |
FAILURE | 0x00000002 | |
| 09:18:07,194 | 1640 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\ |
FAILURE | 0x00000002 | |
| 09:18:07,194 | 1640 | RegOpenKeyExA |
Handle => 0x00000338 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\ |
SUCCESS | 0x00000000 | |
| 09:18:07,194 | 1640 | RegEnumKeyExW |
Index => 0 Handle => 0x00000338 Name => 0 Class => |
SUCCESS | 0x00000000 | |
| 09:18:07,194 | 1640 | RegOpenKeyExA |
Handle => 0x0000033c Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0 |
SUCCESS | 0x00000000 | |
| 09:18:07,194 | 1640 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0 |
FAILURE | 0x00000002 | |
| 09:18:07,194 | 1640 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0 |
FAILURE | 0x00000002 | |
| 09:18:07,194 | 1640 | RegOpenKeyExA |
Handle => 0x00000340 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0 |
SUCCESS | 0x00000000 | |
| 09:18:07,194 | 1640 | RegQueryValueExW |
Handle => 0x00000340 Data => 33 ValueName => Flags |
SUCCESS | 0x00000000 | |
| 09:18:07,194 | 1640 | RegCloseKey |
Handle => 0x00000340 |
SUCCESS | 0x00000000 | |
| 09:18:07,194 | 1640 | RegCloseKey |
Handle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:18:07,194 | 1640 | RegEnumKeyExW |
Index => 1 Handle => 0x00000338 Name => 1 Class => |
SUCCESS | 0x00000000 | |
| 09:18:07,194 | 1640 | RegOpenKeyExA |
Handle => 0x0000033c Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1 |
SUCCESS | 0x00000000 | |
| 09:18:07,194 | 1640 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1 |
FAILURE | 0x00000002 | |
| 09:18:07,194 | 1640 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1 |
FAILURE | 0x00000002 | |
| 09:18:07,194 | 1640 | RegOpenKeyExA |
Handle => 0x00000340 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1 |
SUCCESS | 0x00000000 | |
| 09:18:07,194 | 1640 | RegQueryValueExW |
Handle => 0x00000340 Data => 219 ValueName => Flags |
SUCCESS | 0x00000000 | |
| 09:18:07,194 | 1640 | RegOpenKeyExA |
Handle => 0x00000344 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ |
SUCCESS | 0x00000000 | |
| 09:18:07,194 | 1640 | RegSetValueExW |
Handle => 0x00000344 Buffer => 1 ValueName => ProxyBypass Type => 4 |
SUCCESS | 0x00000000 | |
| 09:18:07,194 | 1640 | RegSetValueExW |
Handle => 0x00000344 Buffer => 1 ValueName => IntranetName Type => 4 |
SUCCESS | 0x00000000 | |
| 09:18:07,194 | 1640 | RegSetValueExW |
Handle => 0x00000344 Buffer => 1 ValueName => UNCAsIntranet Type => 4 |
SUCCESS | 0x00000000 | |
| 09:18:07,194 | 1640 | RegCloseKey |
Handle => 0x00000344 |
SUCCESS | 0x00000000 | |
| 09:18:07,194 | 1640 | RegCloseKey |
Handle => 0x00000340 |
SUCCESS | 0x00000000 | |
| 09:18:07,194 | 1640 | RegCloseKey |
Handle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:18:07,194 | 1640 | RegEnumKeyExW |
Index => 2 Handle => 0x00000338 Name => 2 Class => |
SUCCESS | 0x00000000 | |
| 09:18:07,194 | 1640 | RegOpenKeyExA |
Handle => 0x0000033c Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2 |
SUCCESS | 0x00000000 | |
| 09:18:07,194 | 1640 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2 |
FAILURE | 0x00000002 | |
| 09:18:07,194 | 1640 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2 |
FAILURE | 0x00000002 | |
| 09:18:07,194 | 1640 | RegOpenKeyExA |
Handle => 0x00000340 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2 |
SUCCESS | 0x00000000 | |
| 09:18:07,194 | 1640 | RegQueryValueExW |
Handle => 0x00000340 Data => 71 ValueName => Flags |
SUCCESS | 0x00000000 | |
| 09:18:07,194 | 1640 | RegCloseKey |
Handle => 0x00000340 |
SUCCESS | 0x00000000 | |
| 09:18:07,194 | 1640 | RegCloseKey |
Handle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:18:07,194 | 1640 | RegEnumKeyExW |
Index => 3 Handle => 0x00000338 Name => 3 Class => |
SUCCESS | 0x00000000 | |
| 09:18:07,194 | 1640 | RegOpenKeyExA |
Handle => 0x0000033c Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3 |
SUCCESS | 0x00000000 | |
| 09:18:07,194 | 1640 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3 |
FAILURE | 0x00000002 | |
| 09:18:07,194 | 1640 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3 |
FAILURE | 0x00000002 | |
| 09:18:07,194 | 1640 | RegOpenKeyExA |
Handle => 0x00000340 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 |
SUCCESS | 0x00000000 | |
| 09:18:07,194 | 1640 | RegQueryValueExW |
Handle => 0x00000340 Data => 1 ValueName => Flags |
SUCCESS | 0x00000000 | |
| 09:18:07,194 | 1640 | RegCloseKey |
Handle => 0x00000340 |
SUCCESS | 0x00000000 | |
| 09:18:07,194 | 1640 | RegCloseKey |
Handle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:18:07,194 | 1640 | RegEnumKeyExW |
Index => 4 Handle => 0x00000338 Name => 4 Class => |
SUCCESS | 0x00000000 | |
| 09:18:07,194 | 1640 | RegOpenKeyExA |
Handle => 0x0000033c Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4 |
SUCCESS | 0x00000000 | |
| 09:18:07,194 | 1640 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4 |
FAILURE | 0x00000002 | |
| 09:18:07,194 | 1640 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4 |
FAILURE | 0x00000002 | |
| 09:18:07,194 | 1640 | RegOpenKeyExA |
Handle => 0x00000340 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 |
SUCCESS | 0x00000000 | |
| 09:18:07,194 | 1640 | RegQueryValueExW |
Handle => 0x00000340 Data => 3 ValueName => Flags |
SUCCESS | 0x00000000 | |
| 09:18:07,194 | 1640 | RegCloseKey |
Handle => 0x00000340 |
SUCCESS | 0x00000000 | |
| 09:18:07,194 | 1640 | RegCloseKey |
Handle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:18:07,194 | 1640 | RegEnumKeyExW |
Index => 5 Handle => 0x00000338 Name => 4 Class => |
FAILURE | 0x00000103 | |
| 09:18:07,194 | 1640 | RegCloseKey |
Handle => 0x00000338 |
SUCCESS | 0x00000000 | |
| 09:18:07,194 | 1640 | RegOpenKeyExA |
Handle => 0x0000033a Registry => 0x80000000 SubKey => PROTOCOLS\Name-Space Handler\ |
SUCCESS | 0x00000000 | |
| 09:18:07,194 | 1640 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000000 SubKey => PROTOCOLS\Name-Space Handler\C\ |
FAILURE | 0x00000002 | |
| 09:18:07,194 | 1640 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000000 SubKey => PROTOCOLS\Name-Space Handler\*\ |
FAILURE | 0x00000002 | |
| 09:18:07,194 | 1640 | RegCloseKey |
Handle => 0x0000033a |
SUCCESS | 0x00000000 | |
| 09:18:07,194 | 1640 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000001 SubKey => SOFTWARE\Classes\PROTOCOLS\Handler\C |
FAILURE | 0x00000002 | |
| 09:18:07,194 | 1640 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000002 SubKey => SOFTWARE\Classes\PROTOCOLS\Handler\C |
FAILURE | 0x00000002 | |
| 09:18:07,194 | 1640 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000001 SubKey => SOFTWARE\Classes\PROTOCOLS\Handler\C |
FAILURE | 0x00000002 | |
| 09:18:07,194 | 1640 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000002 SubKey => SOFTWARE\Classes\PROTOCOLS\Handler\C |
FAILURE | 0x00000002 | |
| 09:18:07,194 | 1640 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32 |
SUCCESS | 0x00000000 | |
| 09:18:07,194 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetLongPathNameW FunctionAddress => 0x7c8133e3 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:18:07,194 | 1640 | FindFirstFileExW |
FileName => C:\Program Files\Adobe |
SUCCESS | 0x00243330 | |
| 09:18:07,204 | 1640 | FindFirstFileExW |
FileName => C:\Program Files\Adobe\Reader 11.0\Reader |
SUCCESS | 0x00243330 | |
| 09:18:07,204 | 1640 | FindFirstFileExW |
FileName => C:\Program Files\Adobe\Reader 11.0\Reader\Eula.exe |
SUCCESS | 0x00243330 | |
| 09:18:07,204 | 1640 | LdrLoadDll |
Flags => 33285480 BaseAddress => 0x7c9c0000 FileName => shell32.dll |
SUCCESS | 0x00000000 | |
| 09:18:07,204 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => SHGetFolderPathW FunctionAddress => 0x7c9eed76 ModuleHandle => 0x7c9c0000 |
SUCCESS | 0x00000000 | |
| 09:18:07,204 | 1640 | RegCreateKeyExW |
Handle => 0x00000338 Access => 33554432 Registry => 0x80000001 Class => SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders |
SUCCESS | 0x00000000 | |
| 09:18:07,204 | 1640 | RegQueryValueExW |
Handle => 0x00000338 Data => %\x00U\x00S\x00E\x00R\x00P\x00R\x00O\x00F\x00I\x00L\x00E\x00%\x00\\x00C\x00o\x00o\x00k\x00i\x00e\x00s\x00\x00\x00 ValueName => Cookies |
SUCCESS | 0x00000000 | |
| 09:18:07,204 | 1640 | RegCloseKey |
Handle => 0x00000338 |
SUCCESS | 0x00000000 | |
| 09:18:07,204 | 1640 | RegCreateKeyExW |
Handle => 0x00000338 Access => 33554432 Registry => 0x80000001 Class => SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders |
SUCCESS | 0x00000000 | |
| 09:18:07,204 | 1640 | RegSetValueExW |
Handle => 0x00000338 Buffer => C\x00:\x00\\x00D\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00s\x00 \x00a\x00n\x00d\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00D\x00W\x00\\x00C\x00o\x00o\x00k\x00i\x00e\x00s\x00\x00\x00 ValueName => Cookies Type => 1 |
SUCCESS | 0x00000000 | |
| 09:18:07,204 | 1640 | RegCloseKey |
Handle => 0x00000338 |
SUCCESS | 0x00000000 | |
| 09:18:07,204 | 1640 | FindFirstFileExW |
FileName => C:\Program Files\Adobe |
SUCCESS | 0x00243330 | |
| 09:18:07,204 | 1640 | FindFirstFileExW |
FileName => C:\Program Files\Adobe\Reader 11.0\Reader |
SUCCESS | 0x00243330 | |
| 09:18:07,204 | 1640 | FindFirstFileExW |
FileName => C:\Program Files\Adobe\Reader 11.0\Reader\Eula.exe |
SUCCESS | 0x00243330 | |
| 09:18:07,214 | 1640 | RegOpenKeyExA |
Handle => 0x00000338 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0 |
SUCCESS | 0x00000000 | |
| 09:18:07,214 | 1640 | RegQueryValueExW |
Handle => 0x00000338 Data => 0 ValueName => 1806 |
SUCCESS | 0x00000000 | |
| 09:18:07,214 | 1640 | RegCloseKey |
Handle => 0x00000338 |
SUCCESS | 0x00000000 | |
| 09:18:07,214 | 1640 | RegOpenKeyExW |
Handle => 0x00000338 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:18:07,214 | 1640 | RegQueryValueExW |
Handle => 0x00000338 DataLength => 4 ValueName => Security_HKLM_only Type => 33289500 |
FAILURE | 0x00000002 | |
| 09:18:07,214 | 1640 | RegCloseKey |
Handle => 0x00000338 |
SUCCESS | 0x00000000 | |
| 09:18:07,214 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:18:07,214 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:18:07,214 | 1640 | RegOpenKeyExW |
Handle => 0x00000338 Registry => 0x80000002 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
SUCCESS | 0x00000000 | |
| 09:18:07,214 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:18:07,214 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x00000338 SubKey => FEATURE_RESPECT_OBJECTSAFETY_POLICY_KB905547 |
FAILURE | 0x00000002 | |
| 09:18:07,214 | 1640 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | 1 time |
| 09:18:07,224 | 1640 | RegCloseKey |
Handle => 0x00000338 |
SUCCESS | 0x00000000 | |
| 09:18:07,224 | 1640 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | |
| 09:18:07,224 | 1640 | RegCloseKey |
Handle => 0x00000330 |
SUCCESS | 0x00000000 | |
| 09:18:07,224 | 1640 | RegCloseKey |
Handle => 0x00000328 |
SUCCESS | 0x00000000 | |
| 09:18:07,224 | 1640 | NtOpenKey |
DesiredAccess => 131097 KeyHandle => 0x00000328 ObjectAttributes => \Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers |
SUCCESS | 0x00000000 | |
| 09:18:07,224 | 1640 | NtQueryValueKey |
Information => 1 KeyHandle => 0x00000328 ValueName => TransparentEnabled Type => 4 |
SUCCESS | 0x00000000 | |
| 09:18:07,224 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x00000278 SubKey => .exe |
FAILURE | 0x00000002 | 1 time |
| 09:18:07,224 | 1640 | RegOpenKeyExW |
Handle => 0x0000032a Registry => 0x80000000 SubKey => .exe |
SUCCESS | 0x00000000 | |
| 09:18:07,224 | 1640 | RegQueryValueExW |
Handle => 0x0000032a Data => e\x00x\x00e\x00f\x00i\x00l\x00e\x00\x00\x00 ValueName => |
SUCCESS | 0x00000000 | |
| 09:18:07,224 | 1640 | RegOpenKeyExW |
Handle => 0x00000332 Registry => 0x80000000 SubKey => exefile |
SUCCESS | 0x00000000 | |
| 09:18:07,224 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x00000332 SubKey => CurVer |
FAILURE | 0x00000002 | |
| 09:18:07,224 | 1640 | RegOpenKeyExW |
Handle => 0x0000033a Registry => 0x00000332 SubKey => |
SUCCESS | 0x00000000 | |
| 09:18:07,224 | 1640 | RegCloseKey |
Handle => 0x00000332 |
SUCCESS | 0x00000000 | |
| 09:18:07,224 | 1640 | RegOpenKeyExW |
Handle => 0x00000332 Registry => 0x0000033a SubKey => shell\open |
SUCCESS | 0x00000000 | |
| 09:18:07,224 | 1640 | RegOpenKeyExW |
Handle => 0x0000033e Registry => 0x00000332 SubKey => command |
SUCCESS | 0x00000000 | |
| 09:18:07,224 | 1640 | RegQueryValueExW |
Handle => 0x0000033e Data => "\x00%\x001\x00"\x00 \x00%\x00*\x00\x00\x00 ValueName => |
SUCCESS | 0x00000000 | |
| 09:18:07,224 | 1640 | RegCloseKey |
Handle => 0x0000033e |
SUCCESS | 0x00000000 | |
| 09:18:07,234 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\RestrictRun |
FAILURE | 0x00000002 | |
| 09:18:07,234 | 1640 | RegOpenKeyExW |
Handle => 0x0000033e Registry => 0x00000332 SubKey => command |
SUCCESS | 0x00000000 | |
| 09:18:07,234 | 1640 | RegQueryValueExW |
Handle => 0x0000033e DataLength => 256 ValueName => command Type => 33290200 |
FAILURE | 0x00000002 | |
| 09:18:07,234 | 1640 | RegCloseKey |
Handle => 0x0000033e |
SUCCESS | 0x00000000 | |
| 09:18:07,234 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\App Paths\Eula.exe |
FAILURE | 0x00000002 | |
| 09:18:07,234 | 1640 | RegOpenKeyExW |
Handle => 0x0000033e Registry => 0x00000332 SubKey => command |
SUCCESS | 0x00000000 | |
| 09:18:07,234 | 1640 | RegQueryValueExW |
Handle => 0x0000033e Data => "\x00%\x001\x00"\x00 \x00%\x00*\x00\x00\x00 ValueName => |
SUCCESS | 0x00000000 | |
| 09:18:07,234 | 1640 | RegCloseKey |
Handle => 0x0000033e |
SUCCESS | 0x00000000 | |
| 09:18:07,234 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x00000332 SubKey => ddeexec |
FAILURE | 0x00000002 | |
| 09:18:07,234 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000000 SubKey => Applications\Eula.exe |
FAILURE | 0x00000002 | |
| 09:18:07,234 | 1640 | RegOpenKeyExW |
Handle => 0x0000033c Registry => 0x80000001 SubKey => Software\Microsoft\Windows\ShellNoRoam |
SUCCESS | 0x00000000 | |
| 09:18:07,234 | 1640 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => userenv |
FAILURE | 3221225781 | 1 time |
| 09:18:07,234 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetProfileType FunctionAddress => 0x77f96930 ModuleHandle => 0x00400000 |
FAILURE | 3221225594 | |
| 09:18:07,234 | 1640 | RegOpenKeyExW |
Handle => 0x00000340 Registry => 0x0000033c SubKey => MUICache |
SUCCESS | 0x00000000 | |
| 09:18:07,234 | 1640 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => KERNEL32 |
SUCCESS | 0x00000000 | |
| 09:18:07,234 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetUserDefaultUILanguage FunctionAddress => 0x7c813100 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:18:07,234 | 1640 | RegQueryValueExW |
Handle => 0x00000340 Data => ValueName => LangID |
SUCCESS | 0x00000000 | |
| 09:18:07,244 | 1640 | RegOpenKeyExW |
Handle => 0x00000344 Registry => 0x00000340 SubKey => |
SUCCESS | 0x00000000 | |
| 09:18:07,244 | 1640 | RegQueryValueExW |
Handle => 0x00000344 DataLength => 520 ValueName => C:\Program Files\Adobe\Reader 11.0\Reader\Eula.exe Type => 33289760 |
FAILURE | 0x00000002 | |
| 09:18:07,244 | 1640 | RegCloseKey |
Handle => 0x00000344 |
SUCCESS | 0x00000000 | |
| 09:18:07,244 | 1640 | LdrLoadDll |
Flags => 33288528 BaseAddress => 0x77c00000 FileName => VERSION.dll |
SUCCESS | 0x00000000 | |
| 09:18:07,244 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetFileVersionInfoSizeW FunctionAddress => 0x77c0138c ModuleHandle => 0x77c00000 |
SUCCESS | 0x00000000 | |
| 09:18:07,354 | 1640 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => C:\Program Files\Adobe\Reader 11.0\Reader\Eula.exe |
FAILURE | 3221225781 | |
| 09:18:07,354 | 1640 | NtCreateFile |
ShareAccess => 5 FileName => C:\Program Files\Adobe\Reader 11.0\Reader\Eula.exe DesiredAccess => 0x80100080 CreateDisposition => 1 FileHandle => 0x00000348 |
SUCCESS | 0x00000000 | |
| 09:18:07,354 | 1640 | NtCreateSection |
ObjectAttributes => DesiredAccess => 0x000f0005 SectionHandle => 0x00000344 FileHandle => 0x00000348 |
SUCCESS | 0x00000000 | |
| 09:18:07,354 | 1640 | ZwMapViewOfSection |
SectionOffset => 0x01fbeeec SectionHandle => 0x00000344 ProcessHandle => 0xffffffff BaseAddress => 0x020f0000 |
SUCCESS | 0x00000000 | |
| 09:18:07,364 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetFileVersionInfoW FunctionAddress => 0x77c0166f ModuleHandle => 0x77c00000 |
SUCCESS | 0x00000000 | |
| 09:18:07,364 | 1640 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => C:\Program Files\Adobe\Reader 11.0\Reader\Eula.exe |
FAILURE | 3221225781 | |
| 09:18:07,374 | 1640 | NtCreateFile |
ShareAccess => 5 FileName => C:\Program Files\Adobe\Reader 11.0\Reader\Eula.exe DesiredAccess => 0x80100080 CreateDisposition => 1 FileHandle => 0x00000348 |
SUCCESS | 0x00000000 | |
| 09:18:07,374 | 1640 | NtCreateSection |
ObjectAttributes => DesiredAccess => 0x000f0005 SectionHandle => 0x00000344 FileHandle => 0x00000348 |
SUCCESS | 0x00000000 | |
| 09:18:07,374 | 1640 | ZwMapViewOfSection |
SectionOffset => 0x01fbeedc SectionHandle => 0x00000344 ProcessHandle => 0xffffffff BaseAddress => 0x020f0000 |
SUCCESS | 0x00000000 | |
| 09:18:07,374 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => VerQueryValueW FunctionAddress => 0x77c01805 ModuleHandle => 0x77c00000 |
SUCCESS | 0x00000000 | |
| 09:18:07,374 | 1640 | RegOpenKeyExW |
Handle => 0x00000344 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\FileAssociation |
SUCCESS | 0x00000000 | |
| 09:18:07,374 | 1640 | RegQueryValueExW |
Handle => 0x00000344 DataLength => 68 ValueName => CutList Type => 7 |
SUCCESS | 0x00000000 | |
| 09:18:07,374 | 1640 | RegCloseKey |
Handle => 0x00000344 |
SUCCESS | 0x00000000 | |
| 09:18:07,374 | 1640 | RegOpenKeyExW |
Handle => 0x00000344 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\FileAssociation |
SUCCESS | 0x00000000 | |
| 09:18:07,374 | 1640 | RegQueryValueExW |
Handle => 0x00000344 Data => ValueName => CutList |
SUCCESS | 0x00000000 | |
| 09:18:07,374 | 1640 | RegCloseKey |
Handle => 0x00000344 |
SUCCESS | 0x00000000 | |
| 09:18:07,374 | 1640 | RegOpenKeyExW |
Handle => 0x00000344 Registry => 0x00000340 SubKey => |
SUCCESS | 0x00000000 | |
| 09:18:07,374 | 1640 | RegSetValueExW |
Handle => 0x00000344 Buffer => E\x00u\x00l\x00a\x00 \x00d\x00i\x00s\x00p\x00l\x00a\x00y\x00\x00\x00 ValueName => C:\Program Files\Adobe\Reader 11.0\Reader\Eula.exe Type => 1 |
SUCCESS | 0x00000000 | |
| 09:18:07,374 | 1640 | RegCloseKey |
Handle => 0x00000344 |
SUCCESS | 0x00000000 | |
| 09:18:07,374 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Program Files\Adobe\Reader 11.0\Reader\Eula.exe DesiredAccess => 0x80100180 CreateDisposition => 1 FileHandle => 0x00000344 |
SUCCESS | 0x00000000 | |
| 09:18:07,374 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000344 FileInformation => \x00s?\xb30\x9a\xcd\x01\x90?\xd5\xb6\x8a\xa2\xcf\x01\x00s?\xb30\x9a\xcd\x01\xd0\xf3\x9c\xc3\xe6\x91\xcf\x01 \x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:18:07,384 | 1640 | NtSetInformationFile |
FileHandle => 0x00000344 FileInformation => |
SUCCESS | 0x00000000 | |
| 09:18:07,384 | 1640 | NtReadFile |
Buffer => MZ\x90\x00\x03\x00\x00\x00\x04\x00\x00\x00\xff\xff\x00\x00\xb8\x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xf0\x00\x00\x00 FileHandle => 0x00000344 |
SUCCESS | 0x00000000 | |
| 09:18:07,384 | 1640 | NtSetInformationFile |
FileHandle => 0x00000344 FileInformation => |
SUCCESS | 0x00000000 | |
| 09:18:07,384 | 1640 | NtReadFile |
Buffer => PE\x00\x00L\x01\x05\x00\xb0\xc5_P\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00"\x01\x0b\x01
\x00\x00\xaa\x00\x00\x00\x84\x00\x00\x00\x00\x00\x00\xa9\xad\x00\x00\x00\x10\x00\x00\x00\xc0\x00\x00\x00\x00@\x00\x00\x10\x00\x00\x00\x02\x00\x00 FileHandle => 0x00000344 |
SUCCESS | 0x00000000 | |
| 09:18:07,384 | 1640 | NtSetInformationFile |
FileHandle => 0x00000344 FileInformation => |
SUCCESS | 0x00000000 | |
| 09:18:07,384 | 1640 | NtReadFile |
Buffer => \x05\x00\x01\x00 FileHandle => 0x00000344 |
SUCCESS | 0x00000000 | |
| 09:18:07,384 | 1640 | NtSetInformationFile |
FileHandle => 0x00000344 FileInformation => |
SUCCESS | 0x00000000 | |
| 09:18:07,384 | 1640 | NtReadFile |
Buffer => \x02\x00@\x81 FileHandle => 0x00000344 |
SUCCESS | 0x00000000 | |
| 09:18:07,384 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\App Paths\Eula.exe |
FAILURE | 0x00000002 | |
| 09:18:07,384 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
FAILURE | 0x00000002 | |
| 09:18:07,384 | 1640 | RegOpenKeyExW |
Handle => 0x00000344 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
SUCCESS | 0x00000000 | |
| 09:18:07,384 | 1640 | RegQueryValueExW |
Handle => 0x00000344 DataLength => 4 ValueName => InheritConsoleHandles Type => 33289916 |
FAILURE | 0x00000002 | |
| 09:18:07,384 | 1640 | RegCloseKey |
Handle => 0x00000344 |
SUCCESS | 0x00000000 | |
| 09:18:07,384 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
FAILURE | 0x00000002 | |
| 09:18:07,384 | 1640 | RegOpenKeyExW |
Handle => 0x00000344 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
SUCCESS | 0x00000000 | |
| 09:18:07,384 | 1640 | RegQueryValueExW |
Handle => 0x00000344 DataLength => 4 ValueName => RestrictRun Type => 33290472 |
FAILURE | 0x00000002 | |
| 09:18:07,384 | 1640 | RegCloseKey |
Handle => 0x00000344 |
SUCCESS | 0x00000000 | |
| 09:18:07,384 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
FAILURE | 0x00000002 | |
| 09:18:07,384 | 1640 | RegOpenKeyExW |
Handle => 0x00000344 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
SUCCESS | 0x00000000 | |
| 09:18:07,384 | 1640 | RegQueryValueExW |
Handle => 0x00000344 DataLength => 4 ValueName => DisallowRun Type => 33290472 |
FAILURE | 0x00000002 | |
| 09:18:07,384 | 1640 | RegCloseKey |
Handle => 0x00000344 |
SUCCESS | 0x00000000 | |
| 09:18:07,384 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\App Paths\Eula.exe |
FAILURE | 0x00000002 | 1 time |
| 09:18:07,384 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
FAILURE | 0x00000002 | |
| 09:18:07,384 | 1640 | RegOpenKeyExW |
Handle => 0x00000344 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
SUCCESS | 0x00000000 | |
| 09:18:07,384 | 1640 | RegQueryValueExW |
Handle => 0x00000344 DataLength => 4 ValueName => NoRunasInstallPrompt Type => 33287748 |
FAILURE | 0x00000002 | |
| 09:18:07,384 | 1640 | RegCloseKey |
Handle => 0x00000344 |
SUCCESS | 0x00000000 | |
| 09:18:07,384 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\App Paths\Eula.exe |
FAILURE | 0x00000002 | |
| 09:18:08,286 | 1640 | CreateProcessInternalW |
ApplicationName => C:\Program Files\Adobe\Reader 11.0\Reader\Eula.exe ProcessId => 1732 CommandLine => "C:\Program Files\Adobe\Reader 11.0\Reader\Eula.exe" Adobe Reader XI;65758;1033 ThreadHandle => 0x00000354 ProcessHandle => 0x0000034c ThreadId => 552 CreationFlags => 0x04000410 |
SUCCESS | 0x00000001 | |
| 09:18:08,286 | 1640 | LdrGetDllHandle |
ModuleHandle => 0x774e0000 FileName => ole32.dll |
SUCCESS | 0x00000000 | |
| 09:18:08,286 | 1640 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => browseui.dll |
FAILURE | 3221225781 | 1 time |
| 09:18:08,286 | 1640 | RegCloseKey |
Handle => 0x00000332 |
SUCCESS | 0x00000000 | |
| 09:18:08,296 | 1640 | RegCloseKey |
Handle => 0x0000032a |
SUCCESS | 0x00000000 | |
| 09:18:08,296 | 1640 | RegCloseKey |
Handle => 0x0000033a |
SUCCESS | 0x00000000 | |
| 09:18:08,927 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243330 | |
| 09:18:08,927 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe |
SUCCESS | 0x00243330 | |
| 09:18:08,927 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat |
SUCCESS | 0x00243330 | |
| 09:18:08,927 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00243330 | |
| 09:18:08,937 | 1640 | NtCreateFile |
ShareAccess => 0 FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0\UserCache.bin DesiredAccess => 0x0012019f CreateDisposition => 5 FileHandle => 0x0000034c |
SUCCESS | 0x00000000 | |
| 09:18:08,937 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000354 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:08,937 | 1640 | NtQueryInformationFile |
FileHandle => 0x0000034c FileInformation => \x00(\xc5\xb7\x8a\xa2\xcf\x01\x00(\xc5\xb7\x8a\xa2\xcf\x01\x00(\xc5\xb7\x8a\xa2\xcf\x01\x00(\xc5\xb7\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00BL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xb8\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:09,988 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => NtCreateEvent FunctionAddress => 0x7c90d070 ModuleHandle => 0x7c900000 |
SUCCESS | 0x00000000 | |
| 09:18:10,258 | 1640 | NtCreateKey |
ObjectAttributes => Software\Adobe\Adobe Acrobat\11.0 DesiredAccess => 196639 KeyHandle => 0x00000354 Class => |
SUCCESS | 0x00000000 | |
| 09:18:10,258 | 1640 | NtCreateKey |
ObjectAttributes => Software\Adobe\Adobe Acrobat\11.0\DiskCabs DesiredAccess => 196639 KeyHandle => 0x00000354 Class => |
SUCCESS | 0x00000000 | |
| 09:18:10,268 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243330 | |
| 09:18:10,268 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000034c |
SUCCESS | 0x00000000 | |
| 09:18:10,268 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000354 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:10,268 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243330 | |
| 09:18:10,278 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00243330 | |
| 09:18:10,278 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000034c |
SUCCESS | 0x00000000 | |
| 09:18:10,278 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000354 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:10,278 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243330 | |
| 09:18:10,278 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00243330 | |
| 09:18:10,278 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00243330 | |
| 09:18:10,278 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000034c |
SUCCESS | 0x00000000 | |
| 09:18:10,288 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000354 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:10,288 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243330 | |
| 09:18:10,288 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00243330 | |
| 09:18:10,288 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00243330 | |
| 09:18:10,288 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000034c |
SUCCESS | 0x00000000 | |
| 09:18:10,288 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000354 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:10,288 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243330 | |
| 09:18:10,288 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00243330 | |
| 09:18:10,288 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00243330 | |
| 09:18:10,299 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000034c |
SUCCESS | 0x00000000 | |
| 09:18:10,299 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000354 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:10,299 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243330 | |
| 09:18:10,299 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00243330 | |
| 09:18:10,299 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00243330 | |
| 09:18:10,299 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00243330 | |
| 09:18:10,309 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243330 | |
| 09:18:10,309 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00243330 | |
| 09:18:10,309 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00243330 | |
| 09:18:10,309 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00243330 | |
| 09:18:10,309 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000034c |
SUCCESS | 0x00000000 | |
| 09:18:10,309 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000354 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:10,309 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243330 | |
| 09:18:10,309 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00243330 | |
| 09:18:10,319 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00243330 | |
| 09:18:10,319 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00243330 | |
| 09:18:10,319 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243330 | |
| 09:18:10,319 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00243330 | |
| 09:18:10,319 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00243330 | |
| 09:18:10,319 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00243330 | |
| 09:18:10,319 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\Collab\ DesiredAccess => 0x00100001 CreateDisposition => 2 FileHandle => 0x0000034c |
SUCCESS | 0x00000000 | |
| 09:18:10,319 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000354 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:10,319 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243330 | |
| 09:18:10,329 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00243330 | |
| 09:18:10,329 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00243330 | |
| 09:18:10,329 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00243330 | |
| 09:18:10,329 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\Collab |
SUCCESS | 0x00243330 | |
| 09:18:10,329 | 1640 | NtCreateKey |
ObjectAttributes => Software\Adobe\Adobe Acrobat\11.0 DesiredAccess => 196639 KeyHandle => 0x00000354 Class => |
SUCCESS | 0x00000000 | |
| 09:18:10,329 | 1640 | NtCreateKey |
ObjectAttributes => Software\Adobe\Adobe Acrobat\11.0\DiskCabs DesiredAccess => 196639 KeyHandle => 0x00000354 Class => |
SUCCESS | 0x00000000 | |
| 09:18:10,339 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243330 | |
| 09:18:10,339 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000034c |
SUCCESS | 0x00000000 | |
| 09:18:10,339 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000354 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:10,339 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243330 | |
| 09:18:10,339 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00243330 | |
| 09:18:10,339 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000034c |
SUCCESS | 0x00000000 | |
| 09:18:10,339 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000354 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:10,339 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243330 | |
| 09:18:10,339 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00243330 | |
| 09:18:10,339 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00243330 | |
| 09:18:10,349 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000034c |
SUCCESS | 0x00000000 | |
| 09:18:10,349 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000354 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:10,349 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243330 | |
| 09:18:10,349 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00243330 | |
| 09:18:10,349 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00243330 | |
| 09:18:10,349 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000034c |
SUCCESS | 0x00000000 | |
| 09:18:10,349 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000354 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:10,349 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243330 | |
| 09:18:10,349 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00243330 | |
| 09:18:10,359 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00243330 | |
| 09:18:10,359 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000034c |
SUCCESS | 0x00000000 | |
| 09:18:10,359 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000354 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:10,359 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243330 | |
| 09:18:10,359 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00243330 | |
| 09:18:10,359 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00243330 | |
| 09:18:10,359 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00243330 | |
| 09:18:10,359 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243330 | |
| 09:18:10,359 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00243330 | |
| 09:18:10,359 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00243330 | |
| 09:18:10,369 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00243330 | |
| 09:18:10,369 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\Collab |
SUCCESS | 0x00243330 | |
| 09:18:10,369 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\Collab\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000034c |
SUCCESS | 0x00000000 | |
| 09:18:10,369 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000354 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:10,369 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243330 | |
| 09:18:10,369 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00243330 | |
| 09:18:10,369 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00243330 | |
| 09:18:10,369 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00243330 | |
| 09:18:10,369 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\Collab |
SUCCESS | 0x00243330 | |
| 09:18:10,369 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243330 | |
| 09:18:10,379 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00243330 | |
| 09:18:10,379 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00243330 | |
| 09:18:10,379 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00243330 | |
| 09:18:10,379 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\Collab |
SUCCESS | 0x00243330 | |
| 09:18:10,399 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243330 | |
| 09:18:10,399 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000034c |
SUCCESS | 0x00000000 | |
| 09:18:10,399 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000354 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:10,409 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243330 | |
| 09:18:10,409 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\desktop.ini |
SUCCESS | 0x00243330 | |
| 09:18:10,409 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243330 | |
| 09:18:10,409 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\desktop.ini |
SUCCESS | 0x00243330 | |
| 09:18:10,419 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243330 | |
| 09:18:10,419 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\desktop.ini |
SUCCESS | 0x00243330 | |
| 09:18:10,419 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243330 | |
| 09:18:10,419 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\desktop.ini |
SUCCESS | 0x00243330 | |
| 09:18:10,429 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243330 | |
| 09:18:10,429 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\desktop.ini |
SUCCESS | 0x00243330 | |
| 09:18:10,429 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243330 | |
| 09:18:10,429 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\desktop.ini |
SUCCESS | 0x00243330 | |
| 09:18:11,190 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243330 | |
| 09:18:11,190 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00243330 | |
| 09:18:11,190 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Flash Player\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000034c |
SUCCESS | 0x00000000 | |
| 09:18:11,190 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000354 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:11,190 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243330 | |
| 09:18:11,190 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00243330 | |
| 09:18:11,200 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Flash Player\AssetCache\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000034c |
SUCCESS | 0x00000000 | |
| 09:18:11,200 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000354 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:11,200 | 1640 | NtOpenKey |
DesiredAccess => 131097 KeyHandle => 0x0000034c ObjectAttributes => \REGISTRY\USER\S-1-5-21-1935655697-1606980848-1060284298-1003 |
SUCCESS | 0x00000000 | |
| 09:18:11,200 | 1640 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x0000034c SubKey => SOFTWARE\Microsoft\Cryptography\Providers\Type 001 |
FAILURE | 0x00000002 | |
| 09:18:11,200 | 1640 | RegOpenKeyExA |
Handle => 0x0000034c Registry => 0x80000002 SubKey => SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types\Type 001 |
SUCCESS | 0x00000000 | |
| 09:18:11,200 | 1640 | RegQueryValueExA |
Handle => 0x0000034c DataLength => 40 ValueName => Name Type => 1 |
SUCCESS | 0x00000000 | |
| 09:18:11,200 | 1640 | RegQueryValueExA |
Handle => 0x0000034c Data => Microsoft Strong Cryptographic Provider\x00 ValueName => Name |
SUCCESS | 0x00000000 | |
| 09:18:11,200 | 1640 | RegCloseKey |
Handle => 0x0000034c |
SUCCESS | 0x00000000 | |
| 09:18:11,200 | 1640 | RegOpenKeyExA |
Handle => 0x0000034c Registry => 0x80000002 SubKey => SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Strong Cryptographic Provider |
SUCCESS | 0x00000000 | |
| 09:18:11,200 | 1640 | RegQueryValueExA |
Handle => 0x0000034c Data => 1 ValueName => Type |
SUCCESS | 0x00000000 | |
| 09:18:11,200 | 1640 | RegQueryValueExA |
Handle => 0x0000034c DataLength => 11 ValueName => Image Path Type => 1 |
SUCCESS | 0x00000000 | |
| 09:18:11,200 | 1640 | RegQueryValueExA |
Handle => 0x0000034c Data => rsaenh.dll\x00 ValueName => Image Path |
SUCCESS | 0x00000000 | |
| 09:18:11,200 | 1640 | LdrGetDllHandle |
ModuleHandle => 0x68000000 FileName => rsaenh.dll |
SUCCESS | 0x00000000 | |
| 09:18:11,200 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPAcquireContext FunctionAddress => 0x6800fb46 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:18:11,200 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPReleaseContext FunctionAddress => 0x6800f017 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:18:11,200 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPGenKey FunctionAddress => 0x6800afb1 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:18:11,200 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPDeriveKey FunctionAddress => 0x6800d086 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:18:11,200 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPDestroyKey FunctionAddress => 0x68009460 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:18:11,200 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPSetKeyParam FunctionAddress => 0x68009638 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:18:11,200 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPGetKeyParam FunctionAddress => 0x68009a22 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:18:11,200 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPExportKey FunctionAddress => 0x6800ba24 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:18:11,200 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPImportKey FunctionAddress => 0x6800bf8a ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:18:11,200 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPEncrypt FunctionAddress => 0x68006c8e ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:18:11,200 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPDecrypt FunctionAddress => 0x68007100 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:18:11,200 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPCreateHash FunctionAddress => 0x680074ba ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:18:11,200 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPHashData FunctionAddress => 0x68007e56 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:18:11,200 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPHashSessionKey FunctionAddress => 0x68007fa0 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:18:11,200 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPDestroyHash FunctionAddress => 0x680082d1 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:18:11,200 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPSignHash FunctionAddress => 0x6800da22 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:18:11,200 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPVerifySignature FunctionAddress => 0x6800df0a ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:18:11,200 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPGenRandom FunctionAddress => 0x6800d7a7 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:18:11,200 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPGetUserKey FunctionAddress => 0x68009562 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:18:11,200 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPSetProvParam FunctionAddress => 0x68009e6d ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:18:11,200 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPGetProvParam FunctionAddress => 0x68009f9c ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:18:11,200 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPSetHashParam FunctionAddress => 0x6800a56f ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:18:11,200 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPGetHashParam FunctionAddress => 0x6800c891 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:18:11,200 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPDuplicateKey FunctionAddress => 0x6800aaae ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:18:11,200 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPDuplicateHash FunctionAddress => 0x6800852e ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:18:11,200 | 1640 | RegOpenKeyExA |
Handle => 0x00000354 Registry => 0x80000002 SubKey => Software\Microsoft\Cryptography |
SUCCESS | 0x00000000 | |
| 09:18:11,200 | 1640 | RegQueryValueExA |
Handle => 0x00000354 DataLength => 37 ValueName => MachineGuid Type => 1 |
SUCCESS | 0x00000000 | |
| 09:18:11,200 | 1640 | RegQueryValueExA |
Handle => 0x00000354 Data => 99d6ed61-80b2-42d4-8c72-45c08cbdb8ae\x00 ValueName => MachineGuid |
SUCCESS | 0x00000000 | |
| 09:18:11,200 | 1640 | RegCloseKey |
Handle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:11,210 | 1640 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Microsoft\Cryptography\Offload |
FAILURE | 0x00000002 | |
| 09:18:11,210 | 1640 | RegCloseKey |
Handle => 0x0000034c |
SUCCESS | 0x00000000 | |
| 09:18:11,210 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243330 | |
| 09:18:11,210 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00243330 | |
| 09:18:11,210 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Flash Player\AssetCache\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000034c |
SUCCESS | 0x00000000 | |
| 09:18:11,210 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000354 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:11,210 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243330 | |
| 09:18:11,210 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00243330 | |
| 09:18:11,210 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Flash Player\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000034c |
SUCCESS | 0x00000000 | |
| 09:18:11,210 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000354 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:11,210 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243330 | |
| 09:18:11,210 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00243330 | |
| 09:18:11,220 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Flash Player\AssetCache\XDRSAYPT DesiredAccess => 0x00100001 CreateDisposition => 2 FileHandle => 0x0000034c |
SUCCESS | 0x00000000 | |
| 09:18:11,220 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000354 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:11,220 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243330 | |
| 09:18:11,220 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00243330 | |
| 09:18:11,220 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Flash Player\AssetCache\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000034c |
SUCCESS | 0x00000000 | |
| 09:18:11,220 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000354 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:11,220 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243330 | |
| 09:18:11,220 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243330 | |
| 09:18:11,220 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00243330 | |
| 09:18:11,220 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00243330 | |
| 09:18:11,220 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243330 | |
| 09:18:11,220 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243330 | |
| 09:18:11,220 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00243330 | |
| 09:18:11,220 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00243330 | |
| 09:18:11,220 | 1640 | NtCreateFile |
ShareAccess => 0 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\FAP1.tmp DesiredAccess => 0x00120089 CreateDisposition => 2 FileHandle => 0x0000034c |
SUCCESS | 0x00000000 | |
| 09:18:11,220 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000354 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:11,220 | 1640 | NtQueryInformationFile |
FileHandle => 0x0000034c FileInformation => \xc0\x8e!\xb9\x8a\xa2\xcf\x01\xc0\x8e!\xb9\x8a\xa2\xcf\x01\xc0\x8e!\xb9\x8a\xa2\xcf\x01\xc0\x8e!\xb9\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00EL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x89\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x8a\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:11,220 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243330 | |
| 09:18:11,230 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243330 | |
| 09:18:11,230 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00243330 | |
| 09:18:11,230 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00243330 | |
| 09:18:11,230 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\FAP1.tmp |
SUCCESS | 0x00243330 | |
| 09:18:11,230 | 1640 | NtCreateFile |
ShareAccess => 0 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\FAP1.tmp DesiredAccess => 0x0012019f CreateDisposition => 5 FileHandle => 0x0000034c |
SUCCESS | 0x00000000 | |
| 09:18:11,230 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000354 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:11,230 | 1640 | NtQueryInformationFile |
FileHandle => 0x0000034c FileInformation => \xc0\x8e!\xb9\x8a\xa2\xcf\x01\xf0\x15#\xb9\x8a\xa2\xcf\x01\xf0\x15#\xb9\x8a\xa2\xcf\x01\xf0\x15#\xb9\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00EL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x8a\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:11,230 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243330 | |
| 09:18:11,230 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243330 | |
| 09:18:11,230 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00243330 | |
| 09:18:11,230 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00243330 | |
| 09:18:11,230 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\FAP1.tmp |
SUCCESS | 0x00243330 | |
| 09:18:11,230 | 1640 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\FAP1.tmp DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x0000034c |
SUCCESS | 0x00000000 | |
| 09:18:11,230 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000354 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:11,260 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => NtCreateEvent FunctionAddress => 0x7c90d070 ModuleHandle => 0x7c900000 |
SUCCESS | 0x00000000 | |
| 09:18:11,280 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243330 | |
| 09:18:11,280 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243330 | |
| 09:18:11,280 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00243330 | |
| 09:18:11,280 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00243330 | |
| 09:18:11,290 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Temp DesiredAccess => 0x00100020 CreateDisposition => 1 FileHandle => 0x0000034c |
SUCCESS | 0x00000000 | |
| 09:18:11,290 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000354 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:11,290 | 1640 | NtQueryInformationFile |
FileHandle => 0x0000034c FileInformation => \x00\xe9\x90|`G9\x000O9\x00|\xd8\x90|\xea\x82 |
FAILURE | 3221225506 | |
| 09:18:17,809 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243330 | |
| 09:18:17,809 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00243330 | |
| 09:18:17,809 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00243330 | |
| 09:18:17,809 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00243330 | |
| 09:18:17,809 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000034c |
SUCCESS | 0x00000000 | |
| 09:18:17,809 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000354 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:17,819 | 1640 | NtQueryInformationFile |
FileHandle => 0x0000034c FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\x90\x8dB\xb6\x8a\xa2\xcf\x01\x90\x8dB\xb6\x8a\xa2\xcf\x01\x90\x8dB\xb6\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:17,819 | 1640 | RegOpenKeyExW |
Handle => 0x0000034c Registry => 0x80000002 SubKey => SOFTWARE\Microsoft\Internet Explorer |
SUCCESS | 0x00000000 | |
| 09:18:17,819 | 1640 | RegQueryValueExW |
Handle => 0x0000034c Data => 6\x00.\x000\x00.\x002\x009\x000\x000\x00.\x005\x005\x001\x002\x00\x00\x00 ValueName => Version |
SUCCESS | 0x00000000 | |
| 09:18:17,819 | 1640 | RegCloseKey |
Handle => 0x0000034c |
SUCCESS | 0x00000000 | |
| 09:18:17,869 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243330 | |
| 09:18:17,869 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000034c |
SUCCESS | 0x00000000 | |
| 09:18:17,869 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000354 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:17,869 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243330 | |
| 09:18:17,869 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe |
SUCCESS | 0x00243330 | |
| 09:18:17,869 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000034c |
SUCCESS | 0x00000000 | |
| 09:18:17,869 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000354 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:17,879 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243330 | |
| 09:18:17,879 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe |
SUCCESS | 0x00243330 | |
| 09:18:17,879 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat |
SUCCESS | 0x00243330 | |
| 09:18:17,879 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000034c |
SUCCESS | 0x00000000 | |
| 09:18:17,879 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000354 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:17,879 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243330 | |
| 09:18:17,879 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe |
SUCCESS | 0x00243330 | |
| 09:18:17,879 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat |
SUCCESS | 0x00243330 | |
| 09:18:17,879 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000034c |
SUCCESS | 0x00000000 | |
| 09:18:17,879 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000354 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:17,879 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243330 | |
| 09:18:17,879 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe |
SUCCESS | 0x00243330 | |
| 09:18:17,879 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat |
SUCCESS | 0x00243330 | |
| 09:18:17,879 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000034c |
SUCCESS | 0x00000000 | |
| 09:18:17,879 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000354 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:17,879 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243330 | |
| 09:18:17,879 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe |
SUCCESS | 0x00243330 | |
| 09:18:17,879 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat |
SUCCESS | 0x00243330 | |
| 09:18:17,879 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00243330 | |
| 09:18:17,879 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000034c |
SUCCESS | 0x00000000 | |
| 09:18:17,879 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000354 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:18,060 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243330 | |
| 09:18:18,060 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe |
SUCCESS | 0x00243330 | |
| 09:18:18,060 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat |
SUCCESS | 0x00243330 | |
| 09:18:18,060 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00243330 | |
| 09:18:18,070 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000034c |
SUCCESS | 0x00000000 | |
| 09:18:18,070 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000354 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:18,070 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243330 | |
| 09:18:18,070 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe |
SUCCESS | 0x00243330 | |
| 09:18:18,070 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat |
SUCCESS | 0x00243330 | |
| 09:18:18,070 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000034c |
SUCCESS | 0x00000000 | |
| 09:18:18,100 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000354 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:18,100 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243330 | |
| 09:18:18,100 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe |
SUCCESS | 0x00243330 | |
| 09:18:18,100 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat |
SUCCESS | 0x00243330 | |
| 09:18:18,100 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00243330 | |
| 09:18:18,100 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000034c |
SUCCESS | 0x00000000 | |
| 09:18:18,100 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000354 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:18,140 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243330 | |
| 09:18:18,140 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe |
SUCCESS | 0x00243330 | |
| 09:18:18,150 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat |
SUCCESS | 0x00243330 | |
| 09:18:18,150 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000034c |
SUCCESS | 0x00000000 | |
| 09:18:18,150 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000354 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:18,150 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243330 | |
| 09:18:18,150 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe |
SUCCESS | 0x00243330 | |
| 09:18:18,150 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat |
SUCCESS | 0x00243330 | |
| 09:18:18,150 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00243330 | |
| 09:18:18,170 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0\SharedDataEvents DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000034c |
SUCCESS | 0x00000000 | |
| 09:18:18,170 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000354 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:18,170 | 1640 | NtQueryInformationFile |
FileHandle => 0x0000034c FileInformation => \x80\xfcB\xbd\x8a\xa2\xcf\x01\x80\xfcB\xbd\x8a\xa2\xcf\x01\x80\xfcB\xbd\x8a\xa2\xcf\x01\x80\xfcB\xbd\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\xf5)\x00\x00\x00\x00\x02\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xbe\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:18,210 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243330 | |
| 09:18:18,210 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe |
SUCCESS | 0x00243330 | |
| 09:18:18,210 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat |
SUCCESS | 0x00243330 | |
| 09:18:18,210 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00243330 | |
| 09:18:18,260 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0\SharedDataEvents-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000034c |
SUCCESS | 0x00000000 | |
| 09:18:18,260 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000354 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:18,260 | 1640 | NtQueryInformationFile |
FileHandle => 0x0000034c FileInformation => \xa0'L\xbd\x8a\xa2\xcf\x01\xa0'L\xbd\x8a\xa2\xcf\x01\xa0'L\xbd\x8a\xa2\xcf\x01\xa0'L\xbd\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\xf6)\x00\x00\x00\x00\x02\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xce\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:18,460 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243330 | |
| 09:18:18,460 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe |
SUCCESS | 0x00243330 | |
| 09:18:18,460 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat |
SUCCESS | 0x00243330 | |
| 09:18:18,460 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00243330 | |
| 09:18:18,460 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243330 | |
| 09:18:18,460 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe |
SUCCESS | 0x00243330 | |
| 09:18:18,460 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat |
SUCCESS | 0x00243330 | |
| 09:18:18,460 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00243330 | |
| 09:18:18,460 | 1640 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0\SharedDataEvents-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x0000034c |
SUCCESS | 0x00000000 | |
| 09:18:18,460 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000354 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:18,460 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243330 | |
| 09:18:18,460 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe |
SUCCESS | 0x00243330 | |
| 09:18:18,460 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat |
SUCCESS | 0x00243330 | |
| 09:18:18,460 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00243330 | |
| 09:18:18,460 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000034c |
SUCCESS | 0x00000000 | |
| 09:18:18,460 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000354 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:18,460 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243330 | |
| 09:18:18,470 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe |
SUCCESS | 0x00243330 | |
| 09:18:18,470 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat |
SUCCESS | 0x00243330 | |
| 09:18:18,470 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00243330 | |
| 09:18:18,470 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000034c |
SUCCESS | 0x00000000 | |
| 09:18:18,470 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000354 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:18,470 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243330 | |
| 09:18:18,470 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe |
SUCCESS | 0x00243330 | |
| 09:18:18,470 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat |
SUCCESS | 0x00243330 | |
| 09:18:18,470 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00243330 | |
| 09:18:18,470 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000034c |
SUCCESS | 0x00000000 | |
| 09:18:18,470 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000354 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:18,470 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243330 | |
| 09:18:18,470 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe |
SUCCESS | 0x00243330 | |
| 09:18:18,470 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat |
SUCCESS | 0x00243330 | |
| 09:18:18,470 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00243330 | |
| 09:18:18,480 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000034c |
SUCCESS | 0x00000000 | |
| 09:18:18,480 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000354 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:18,480 | 1380 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243330 | |
| 09:18:18,480 | 1380 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe |
SUCCESS | 0x00243330 | |
| 09:18:18,480 | 1380 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat |
SUCCESS | 0x00243330 | |
| 09:18:18,480 | 1380 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00243330 | |
| 09:18:18,480 | 1380 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:18,480 | 1380 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000330 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:18,480 | 1656 | CreateRemoteThread |
Parameter => 0x00000000 ProcessHandle => 0xffffffff ThreadId => 0 StartRoutine => 0x7c910230 CreationFlags => 4 |
SUCCESS | 0x0000034c | |
| 09:18:18,480 | 1656 | NtResumeThread |
SuspendCount => 1 ThreadHandle => 0x0000034c |
SUCCESS | 0x00000000 | |
| 09:18:18,480 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243330 | |
| 09:18:18,480 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe |
SUCCESS | 0x00243330 | |
| 09:18:18,480 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat |
SUCCESS | 0x00243330 | |
| 09:18:18,480 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00243330 | |
| 09:18:18,490 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0\SharedDataEvents DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000034c |
SUCCESS | 0x00000000 | |
| 09:18:18,490 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000354 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:18,490 | 1640 | NtQueryInformationFile |
FileHandle => 0x0000034c FileInformation => \x80\xfcB\xbd\x8a\xa2\xcf\x01 \xd4p\xbd\x8a\xa2\xcf\x01 \xd4p\xbd\x8a\xa2\xcf\x01 \xd4p\xbd\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\xf5)\x00\x00\x00\x00\x02\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xbe\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:18,490 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243368 | |
| 09:18:18,490 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe |
SUCCESS | 0x00243368 | |
| 09:18:18,490 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat |
SUCCESS | 0x00243368 | |
| 09:18:18,490 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00243368 | |
| 09:18:18,490 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000034c |
SUCCESS | 0x00000000 | |
| 09:18:18,490 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000354 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:18,490 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243368 | |
| 09:18:18,490 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe |
SUCCESS | 0x00243368 | |
| 09:18:18,490 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat |
SUCCESS | 0x00243368 | |
| 09:18:18,490 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00243368 | |
| 09:18:18,490 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000034c |
SUCCESS | 0x00000000 | |
| 09:18:18,500 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000354 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:18,500 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243368 | |
| 09:18:18,500 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe |
SUCCESS | 0x00243368 | |
| 09:18:18,500 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat |
SUCCESS | 0x00243368 | |
| 09:18:18,500 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00243368 | |
| 09:18:18,500 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0\SharedDataEvents DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000034c |
SUCCESS | 0x00000000 | |
| 09:18:18,500 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000354 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:18,500 | 1640 | NtQueryInformationFile |
FileHandle => 0x0000034c FileInformation => \x80\xfcB\xbd\x8a\xa2\xcf\x01\xe0\xf0v\xbd\x8a\xa2\xcf\x01 \xd4p\xbd\x8a\xa2\xcf\x01 \xd4p\xbd\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\xf5)\x00\x00\x00\x00\x02\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xbe\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:18,851 | 1640 | NtOpenKey |
DesiredAccess => 65547 KeyHandle => 0x00000354 ObjectAttributes => Software\Adobe\Adobe Synchronizer\11.0 |
SUCCESS | 0x00000000 | |
| 09:18:18,851 | 1640 | NtOpenKey |
DesiredAccess => 65547 KeyHandle => 0x00000354 ObjectAttributes => Software\Adobe\Adobe Synchronizer\11.0\Acrobat.com |
SUCCESS | 0x00000000 | |
| 09:18:18,861 | 1640 | NtOpenKey |
DesiredAccess => 65547 KeyHandle => 0x00000354 ObjectAttributes => Software\Adobe\Adobe Synchronizer\11.0\Acrobat.com.v2 |
SUCCESS | 0x00000000 | |
| 09:18:18,871 | 1640 | NtOpenKey |
DesiredAccess => 65547 KeyHandle => 0x00000354 ObjectAttributes => Software\Adobe\Adobe Synchronizer\11.0\CredentialsV2 |
SUCCESS | 0x00000000 | 3 times |
| 09:18:18,911 | 1640 | NtOpenKey |
DesiredAccess => 65547 KeyHandle => 0x00000354 ObjectAttributes => Software\Adobe\Adobe Synchronizer\11.0 |
SUCCESS | 0x00000000 | |
| 09:18:18,911 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243368 | |
| 09:18:18,911 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243368 | |
| 09:18:18,911 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00243368 | |
| 09:18:18,921 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00243368 | |
| 09:18:18,921 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000034c |
SUCCESS | 0x00000000 | |
| 09:18:18,921 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000354 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:18,921 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243368 | |
| 09:18:18,921 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243368 | |
| 09:18:18,921 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00243368 | |
| 09:18:18,921 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00243368 | |
| 09:18:18,921 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000034c |
SUCCESS | 0x00000000 | |
| 09:18:18,931 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000354 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:18,931 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243368 | |
| 09:18:18,931 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243368 | |
| 09:18:18,931 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00243368 | |
| 09:18:18,931 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00243368 | |
| 09:18:18,931 | 1640 | NtCreateFile |
ShareAccess => 1 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\sep14tax-c8.pdf DesiredAccess => 0x00120089 CreateDisposition => 1 FileHandle => 0x0000034c |
SUCCESS | 0x00000000 | |
| 09:18:18,931 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000354 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:18,931 | 1640 | NtQueryInformationFile |
FileHandle => 0x0000034c FileInformation => \xf7R\xaf2\xaf\x91\xcf\x01w\x8c\xbb2\xaf\x91\xcf\x01w\x8c\xbb2\xaf\x91\xcf\x01w\x8c\xbb2\xaf\x91\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00`\x06\x00\x00\x00\x00\x00,R\x06\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\xfcK\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x89\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00~\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:18,931 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243368 | |
| 09:18:18,931 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243368 | |
| 09:18:18,931 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00243368 | |
| 09:18:18,931 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00243368 | |
| 09:18:18,931 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243368 | |
| 09:18:18,931 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243368 | |
| 09:18:18,931 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000034c |
SUCCESS | 0x00000000 | |
| 09:18:18,931 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000354 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:18,931 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243368 | |
| 09:18:18,931 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243368 | |
| 09:18:18,931 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00243368 | |
| 09:18:18,931 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000034c |
SUCCESS | 0x00000000 | |
| 09:18:18,931 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000354 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:18,941 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243368 | |
| 09:18:18,941 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243368 | |
| 09:18:18,941 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00243368 | |
| 09:18:18,941 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00243368 | |
| 09:18:18,941 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243368 | |
| 09:18:18,941 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243368 | |
| 09:18:18,941 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000034c |
SUCCESS | 0x00000000 | |
| 09:18:18,941 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000354 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:18,941 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243368 | |
| 09:18:18,941 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243368 | |
| 09:18:18,941 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00243368 | |
| 09:18:18,941 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000034c |
SUCCESS | 0x00000000 | |
| 09:18:18,941 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000354 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:18,941 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243368 | |
| 09:18:18,941 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243368 | |
| 09:18:18,941 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00243368 | |
| 09:18:18,941 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00243368 | |
| 09:18:18,941 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243368 | |
| 09:18:18,941 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243368 | |
| 09:18:18,941 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000034c |
SUCCESS | 0x00000000 | |
| 09:18:18,941 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000354 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:18,941 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243368 | |
| 09:18:18,941 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243368 | |
| 09:18:18,941 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00243368 | |
| 09:18:18,951 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000034c |
SUCCESS | 0x00000000 | |
| 09:18:18,951 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000354 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:18,951 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243368 | |
| 09:18:18,951 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00243368 | |
| 09:18:18,951 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00243368 | |
| 09:18:18,951 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00243368 | |
| 09:18:18,951 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\Security |
SUCCESS | 0x00243368 | |
| 09:18:18,951 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243368 | |
| 09:18:18,951 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000034c |
SUCCESS | 0x00000000 | |
| 09:18:18,951 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000354 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:18,951 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243368 | |
| 09:18:18,951 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00243368 | |
| 09:18:18,951 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000034c |
SUCCESS | 0x00000000 | |
| 09:18:18,951 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000354 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:18,951 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243368 | |
| 09:18:18,951 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00243368 | |
| 09:18:18,951 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00243368 | |
| 09:18:18,961 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000034c |
SUCCESS | 0x00000000 | |
| 09:18:18,961 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000354 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:18,961 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243368 | |
| 09:18:18,961 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00243368 | |
| 09:18:18,961 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00243368 | |
| 09:18:18,961 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00243368 | |
| 09:18:18,961 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000034c |
SUCCESS | 0x00000000 | |
| 09:18:18,961 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000354 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:18,961 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243368 | |
| 09:18:18,961 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243368 | |
| 09:18:18,961 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00243368 | |
| 09:18:18,961 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00243368 | |
| 09:18:18,961 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243368 | |
| 09:18:18,961 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243368 | |
| 09:18:18,961 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000034c |
SUCCESS | 0x00000000 | |
| 09:18:18,961 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000354 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:18,961 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243368 | |
| 09:18:18,961 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243368 | |
| 09:18:18,961 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00243368 | |
| 09:18:18,961 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000034c |
SUCCESS | 0x00000000 | |
| 09:18:18,961 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000354 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:18,971 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243368 | |
| 09:18:18,971 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00243368 | |
| 09:18:18,971 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00243368 | |
| 09:18:18,971 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00243368 | |
| 09:18:18,971 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\Security |
SUCCESS | 0x00243368 | |
| 09:18:18,971 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243368 | |
| 09:18:18,971 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000034c |
SUCCESS | 0x00000000 | |
| 09:18:18,971 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000354 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:18,971 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243368 | |
| 09:18:18,971 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00243368 | |
| 09:18:18,971 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000034c |
SUCCESS | 0x00000000 | |
| 09:18:18,971 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000354 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:18,971 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243368 | |
| 09:18:18,971 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00243368 | |
| 09:18:18,971 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00243368 | |
| 09:18:18,971 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000034c |
SUCCESS | 0x00000000 | |
| 09:18:18,971 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000354 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:18,981 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243368 | |
| 09:18:18,981 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00243368 | |
| 09:18:18,981 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00243368 | |
| 09:18:18,981 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00243368 | |
| 09:18:18,981 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000034c |
SUCCESS | 0x00000000 | |
| 09:18:18,981 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000354 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:18,981 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243368 | |
| 09:18:18,981 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243368 | |
| 09:18:18,981 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00243368 | |
| 09:18:18,981 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00243368 | |
| 09:18:18,981 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243368 | |
| 09:18:18,981 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243368 | |
| 09:18:18,981 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000034c |
SUCCESS | 0x00000000 | |
| 09:18:18,981 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000354 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:18,981 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243368 | |
| 09:18:18,981 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243368 | |
| 09:18:18,981 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00243368 | |
| 09:18:18,981 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000034c |
SUCCESS | 0x00000000 | |
| 09:18:18,981 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000354 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:18,991 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243368 | |
| 09:18:18,991 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243368 | |
| 09:18:18,991 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00243368 | |
| 09:18:18,991 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00243368 | |
| 09:18:18,991 | 1640 | NtCreateFile |
ShareAccess => 1 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\sep14tax-c8.pdf DesiredAccess => 0x00120089 CreateDisposition => 1 FileHandle => 0x0000034c |
SUCCESS | 0x00000000 | |
| 09:18:18,991 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000354 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:18,991 | 1640 | NtQueryInformationFile |
FileHandle => 0x0000034c FileInformation => \xf7R\xaf2\xaf\x91\xcf\x01 -\xba\xbd\x8a\xa2\xcf\x01w\x8c\xbb2\xaf\x91\xcf\x01w\x8c\xbb2\xaf\x91\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00`\x06\x00\x00\x00\x00\x00,R\x06\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\xfcK\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x89\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00~\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:19,061 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243368 | |
| 09:18:19,061 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00243368 | |
| 09:18:19,061 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00243368 | |
| 09:18:19,061 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00243368 | |
| 09:18:19,061 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000034c |
SUCCESS | 0x00000000 | |
| 09:18:19,061 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000354 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:19,061 | 1640 | NtQueryInformationFile |
FileHandle => 0x0000034c FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\x90\x8dB\xb6\x8a\xa2\xcf\x01\x90\x8dB\xb6\x8a\xa2\xcf\x01\x90\x8dB\xb6\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:19,061 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243368 | |
| 09:18:19,061 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00243368 | |
| 09:18:19,071 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00243368 | |
| 09:18:19,071 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00243368 | |
| 09:18:19,071 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000034c |
SUCCESS | 0x00000000 | |
| 09:18:19,071 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000354 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:19,071 | 1640 | NtQueryInformationFile |
FileHandle => 0x0000034c FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\x90\x8dB\xb6\x8a\xa2\xcf\x01\x90\x8dB\xb6\x8a\xa2\xcf\x01\x90\x8dB\xb6\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:19,412 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243368 | |
| 09:18:19,412 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243368 | |
| 09:18:19,412 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000034c |
SUCCESS | 0x00000000 | |
| 09:18:19,412 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000354 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:19,412 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243368 | |
| 09:18:19,412 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243368 | |
| 09:18:19,412 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00243368 | |
| 09:18:19,412 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000034c |
SUCCESS | 0x00000000 | |
| 09:18:19,412 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000354 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:19,472 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243368 | |
| 09:18:19,472 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Temp |
SUCCESS | 0x00243368 | |
| 09:18:20,113 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CoRegisterClassObject FunctionAddress => 0x77517e90 ModuleHandle => 0x774e0000 |
SUCCESS | 0x00000000 | |
| 09:18:20,113 | 1640 | RegOpenKeyExW |
Handle => 0x0000034c Registry => 0x80000002 SubKey => Software\Microsoft\COM3 |
SUCCESS | 0x00000000 | |
| 09:18:20,113 | 1640 | RegQueryValueExW |
Handle => 0x0000034c Data => ValueName => REGDBVersion |
SUCCESS | 0x00000000 | |
| 09:18:20,113 | 1640 | RegCloseKey |
Handle => 0x0000034c |
SUCCESS | 0x00000000 | |
| 09:18:20,113 | 1640 | RegOpenKeyExW |
Handle => 0x0000034c Registry => 0x80000002 SubKey => Software\Microsoft\COM3 |
SUCCESS | 0x00000000 | |
| 09:18:20,113 | 1640 | RegQueryValueExW |
Handle => 0x0000034c Data => ValueName => REGDBVersion |
SUCCESS | 0x00000000 | |
| 09:18:20,123 | 1640 | RegCloseKey |
Handle => 0x0000034c |
SUCCESS | 0x00000000 | |
| 09:18:20,123 | 1640 | RegOpenKeyExW |
Handle => 0x0000034e Registry => 0x000002aa SubKey => CLSID\{B801CA65-A1FC-11D0-85AD-444553540000} |
SUCCESS | 0x00000000 | |
| 09:18:20,123 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x0000034e SubKey => TreatAs |
FAILURE | 0x00000002 | |
| 09:18:20,123 | 1640 | RegOpenKeyExW |
Handle => 0x00000356 Registry => 0x000002aa SubKey => |
SUCCESS | 0x00000000 | |
| 09:18:20,123 | 1640 | RegCloseKey |
Handle => 0x0000034e |
SUCCESS | 0x00000000 | |
| 09:18:20,123 | 1640 | RegOpenKeyExW |
Handle => 0x0000034e Registry => 0x00000356 SubKey => CLSID\{B801CA65-A1FC-11D0-85AD-444553540000} |
SUCCESS | 0x00000000 | |
| 09:18:20,123 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x0000034e SubKey => InprocServer32 |
FAILURE | 0x00000002 | |
| 09:18:20,123 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x0000034e SubKey => InprocServerX86 |
FAILURE | 0x00000002 | |
| 09:18:20,123 | 1640 | RegOpenKeyExW |
Handle => 0x00000332 Registry => 0x0000034e SubKey => LocalServer32 |
SUCCESS | 0x00000000 | |
| 09:18:20,123 | 1640 | RegQueryValueExW |
Handle => 0x00000332 DataLength => 1000 ValueName => LocalServer32 Type => 33358952 |
FAILURE | 0x00000002 | |
| 09:18:20,123 | 1640 | RegCloseKey |
Handle => 0x00000332 |
SUCCESS | 0x00000000 | |
| 09:18:20,123 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x0000034e SubKey => InprocServer32 |
FAILURE | 0x00000002 | |
| 09:18:20,123 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x0000034e SubKey => InprocServerX86 |
FAILURE | 0x00000002 | |
| 09:18:20,123 | 1640 | RegOpenKeyExW |
Handle => 0x00000332 Registry => 0x0000034e SubKey => InprocHandler32 |
SUCCESS | 0x00000000 | |
| 09:18:20,123 | 1640 | RegQueryValueExW |
Handle => 0x00000332 Data => o\x00l\x00e\x003\x002\x00.\x00d\x00l\x00l\x00\x00\x00 ValueName => |
SUCCESS | 0x00000000 | |
| 09:18:20,123 | 1640 | RegCloseKey |
Handle => 0x00000332 |
SUCCESS | 0x00000000 | |
| 09:18:20,123 | 1640 | RegOpenKeyExW |
Handle => 0x00000332 Registry => 0x0000034e SubKey => LocalServer32 |
SUCCESS | 0x00000000 | |
| 09:18:20,123 | 1640 | RegQueryValueExW |
Handle => 0x00000332 Data => "\x00C\x00:\x00\\x00P\x00r\x00o\x00g\x00r\x00a\x00m\x00 \x00F\x00i\x00l\x00e\x00s\x00\\x00A\x00d\x00o\x00b\x00e\x00\\x00R\x00e\x00a\x00d\x00e\x00r\x00 \x001\x001\x00.\x000\x00\\x00R\x00e\x00a\x00d\x00e\x00r\x00\\x00A\x00c\x00r\x00o\x00R\x00d\x003\x002\x00.\x00e\x00x\x00e\x00"\x00\x00\x00 ValueName => |
SUCCESS | 0x00000000 | |
| 09:18:20,123 | 1640 | RegCloseKey |
Handle => 0x00000332 |
SUCCESS | 0x00000000 | |
| 09:18:20,123 | 1640 | RegCloseKey |
Handle => 0x0000034e |
SUCCESS | 0x00000000 | |
| 09:18:20,123 | 1640 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => C:\WINDOWS\system32\winlogon.exe |
FAILURE | 3221225781 | 1 time |
| 09:18:20,123 | 1640 | RegOpenKeyExW |
Handle => 0x00000348 Registry => 0x80000002 SubKey => Software\Microsoft\Ole |
SUCCESS | 0x00000000 | |
| 09:18:20,123 | 1640 | RegQueryValueExW |
Handle => 0x00000348 DataLength => 4 ValueName => MaximumAllowedAllocationSize Type => 33289812 |
FAILURE | 0x00000002 | |
| 09:18:20,123 | 1640 | RegCloseKey |
Handle => 0x00000348 |
SUCCESS | 0x00000000 | |
| 09:18:20,123 | 1640 | LdrLoadDll |
Flags => 33289776 BaseAddress => 0x02290000 FileName => xpsp2res.dll |
SUCCESS | 0x00000000 | |
| 09:18:20,123 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000000 SubKey => AppID\AcroRd32.exe |
FAILURE | 0x00000002 | |
| 09:18:20,123 | 1640 | RegOpenKeyExW |
Handle => 0x00000344 Registry => 0x80000002 SubKey => SOFTWARE\Microsoft\OLE |
SUCCESS | 0x00000000 | |
| 09:18:20,123 | 1640 | RegQueryValueExW |
Handle => 0x00000344 DataLength => 256 ValueName => DefaultAccessPermission Type => 2335144 |
FAILURE | 0x00000002 | |
| 09:18:20,123 | 1640 | RegCloseKey |
Handle => 0x00000344 |
SUCCESS | 0x00000000 | |
| 09:18:20,133 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => PIPE\lsarpc DesiredAccess => 0xc0100080 CreateDisposition => 1 FileHandle => 0x00000350 |
SUCCESS | 0x00000000 | |
| 09:18:20,133 | 1640 | NtSetInformationFile |
FileHandle => 0x00000350 FileInformation => |
SUCCESS | 0x00000000 | 1 time |
| 09:18:20,133 | 1640 | NtWriteFile |
Buffer => \x05\x00\x0b\x03\x10\x00\x00\x00H\x00\x00\x00\x01\x00\x00\x00\xb8\x10\xb8\x10\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x01\x00xW4\x124\x12\xcd\xab\xef\x00\x01#Eg\x89\xab\x00\x00\x00\x00\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x00\x00 FileHandle => 0x00000350 |
SUCCESS | 0x00000000 | |
| 09:18:20,133 | 1640 | NtReadFile |
Buffer => \x05\x00\x0c\x03\x10\x00\x00\x00D\x00\x00\x00\x01\x00\x00\x00\xb8\x10\xb8\x10\xa6E\x00\x00\x0c\x00\PIPE\lsass\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x00\x00 FileHandle => 0x00000350 |
SUCCESS | 0x00000000 | |
| 09:18:20,133 | 1640 | NtOpenKey |
DesiredAccess => 131097 KeyHandle => 0x00000344 ObjectAttributes => \Registry\Machine\System\CurrentControlSet\Control\ComputerName |
SUCCESS | 0x00000000 | |
| 09:18:20,133 | 1640 | NtOpenKey |
DesiredAccess => 131097 KeyHandle => 0x00000350 ObjectAttributes => ActiveComputerName |
SUCCESS | 0x00000000 | |
| 09:18:20,133 | 1640 | NtQueryValueKey |
Information => T\x00U\x00R\x00B\x00O\x00P\x00C\x00\x00\x00 KeyHandle => 0x00000350 ValueName => ComputerName Type => 1 |
SUCCESS | 0x00000000 | |
| 09:18:20,133 | 1640 | CreateThread |
ThreadId => 2004 StartRoutine => 0x77e76c7d Parameter => 0x001ef598 CreationFlags => 0 |
SUCCESS | 0x00000348 | |
| 09:18:20,133 | 1640 | LdrLoadDll |
Flags => 33290692 BaseAddress => 0x774e0000 FileName => OLE32 |
SUCCESS | 0x00000000 | |
| 09:18:20,133 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CoGetClassObject FunctionAddress => 0x775156c5 ModuleHandle => 0x774e0000 |
SUCCESS | 0x00000000 | |
| 09:18:20,133 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CoGetMarshalSizeMax FunctionAddress => 0x7752d6c0 ModuleHandle => 0x774e0000 |
SUCCESS | 0x00000000 | |
| 09:18:20,133 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CoMarshalInterface FunctionAddress => 0x7750ea71 ModuleHandle => 0x774e0000 |
SUCCESS | 0x00000000 | |
| 09:18:20,133 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CoUnmarshalInterface FunctionAddress => 0x7752d7f4 ModuleHandle => 0x774e0000 |
SUCCESS | 0x00000000 | |
| 09:18:20,133 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => StringFromIID FunctionAddress => 0x7754659b ModuleHandle => 0x774e0000 |
SUCCESS | 0x00000000 | |
| 09:18:20,133 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CoGetPSClsid FunctionAddress => 0x775197f0 ModuleHandle => 0x774e0000 |
SUCCESS | 0x00000000 | |
| 09:18:20,133 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CoTaskMemAlloc FunctionAddress => 0x774fd060 ModuleHandle => 0x774e0000 |
SUCCESS | 0x00000000 | |
| 09:18:20,133 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CoTaskMemFree FunctionAddress => 0x774fd044 ModuleHandle => 0x774e0000 |
SUCCESS | 0x00000000 | |
| 09:18:20,133 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CoCreateInstance FunctionAddress => 0x7750057e ModuleHandle => 0x774e0000 |
SUCCESS | 0x00000000 | |
| 09:18:20,133 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CoReleaseMarshalData FunctionAddress => 0x7750df23 ModuleHandle => 0x774e0000 |
SUCCESS | 0x00000000 | |
| 09:18:20,133 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => DcomChannelSetHResult FunctionAddress => 0x7752b1b7 ModuleHandle => 0x774e0000 |
SUCCESS | 0x00000000 | |
| 09:18:20,133 | 1640 | CreateThread |
ThreadId => 792 StartRoutine => 0x774fe43b Parameter => 0x001e5c88 CreationFlags => 0 |
SUCCESS | 0x00000360 | |
| 09:18:20,133 | 1640 | RegCloseKey |
Handle => 0x00000356 |
SUCCESS | 0x00000000 | |
| 09:18:20,133 | 1640 | RegOpenKeyExW |
Handle => 0x00000354 Registry => 0x80000002 SubKey => Software\Microsoft\COM3 |
SUCCESS | 0x00000000 | |
| 09:18:20,133 | 1640 | RegQueryValueExW |
Handle => 0x00000354 Data => ValueName => REGDBVersion |
SUCCESS | 0x00000000 | |
| 09:18:20,133 | 1640 | RegCloseKey |
Handle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:20,133 | 1640 | RegOpenKeyExW |
Handle => 0x00000354 Registry => 0x80000002 SubKey => Software\Microsoft\COM3 |
SUCCESS | 0x00000000 | |
| 09:18:20,133 | 1640 | RegQueryValueExW |
Handle => 0x00000354 Data => ValueName => REGDBVersion |
SUCCESS | 0x00000000 | |
| 09:18:20,133 | 1640 | RegCloseKey |
Handle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:20,133 | 1640 | RegOpenKeyExW |
Handle => 0x00000356 Registry => 0x000002aa SubKey => CLSID\{B801CA65-A1FC-11D0-85AD-444553540000} |
SUCCESS | 0x00000000 | |
| 09:18:20,133 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x00000356 SubKey => TreatAs |
FAILURE | 0x00000002 | |
| 09:18:20,133 | 1640 | RegOpenKeyExW |
Handle => 0x00000362 Registry => 0x000002aa SubKey => |
SUCCESS | 0x00000000 | |
| 09:18:20,133 | 1640 | RegCloseKey |
Handle => 0x00000356 |
SUCCESS | 0x00000000 | |
| 09:18:20,133 | 1640 | RegOpenKeyExW |
Handle => 0x00000356 Registry => 0x00000362 SubKey => CLSID\{B801CA65-A1FC-11D0-85AD-444553540000} |
SUCCESS | 0x00000000 | |
| 09:18:20,133 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x00000356 SubKey => InprocServer32 |
FAILURE | 0x00000002 | |
| 09:18:20,133 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x00000356 SubKey => InprocServerX86 |
FAILURE | 0x00000002 | |
| 09:18:20,133 | 1640 | RegOpenKeyExW |
Handle => 0x00000366 Registry => 0x00000356 SubKey => LocalServer32 |
SUCCESS | 0x00000000 | |
| 09:18:20,133 | 1640 | RegQueryValueExW |
Handle => 0x00000366 DataLength => 1000 ValueName => LocalServer32 Type => 33358952 |
FAILURE | 0x00000002 | |
| 09:18:20,143 | 792 | LdrLoadDll |
Flags => 41287540 BaseAddress => 0x774e0000 FileName => OLE32.DLL |
SUCCESS | 0x00000000 | |
| 09:18:20,143 | 792 | NtDelayExecution |
Milliseconds => 60000 |
SUCCESS | 0x00000000 | |
| 09:18:20,143 | 1640 | RegCloseKey |
Handle => 0x00000366 |
SUCCESS | 0x00000000 | |
| 09:18:20,143 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x00000356 SubKey => InprocServer32 |
FAILURE | 0x00000002 | |
| 09:18:20,143 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x00000356 SubKey => InprocServerX86 |
FAILURE | 0x00000002 | |
| 09:18:20,143 | 1640 | RegOpenKeyExW |
Handle => 0x00000366 Registry => 0x00000356 SubKey => InprocHandler32 |
SUCCESS | 0x00000000 | |
| 09:18:20,143 | 1640 | RegQueryValueExW |
Handle => 0x00000366 Data => o\x00l\x00e\x003\x002\x00.\x00d\x00l\x00l\x00\x00\x00 ValueName => |
SUCCESS | 0x00000000 | |
| 09:18:20,143 | 1640 | RegCloseKey |
Handle => 0x00000366 |
SUCCESS | 0x00000000 | |
| 09:18:20,143 | 1640 | RegOpenKeyExW |
Handle => 0x00000366 Registry => 0x00000356 SubKey => LocalServer32 |
SUCCESS | 0x00000000 | |
| 09:18:20,143 | 1640 | RegQueryValueExW |
Handle => 0x00000366 Data => "\x00C\x00:\x00\\x00P\x00r\x00o\x00g\x00r\x00a\x00m\x00 \x00F\x00i\x00l\x00e\x00s\x00\\x00A\x00d\x00o\x00b\x00e\x00\\x00R\x00e\x00a\x00d\x00e\x00r\x00 \x001\x001\x00.\x000\x00\\x00R\x00e\x00a\x00d\x00e\x00r\x00\\x00A\x00c\x00r\x00o\x00R\x00d\x003\x002\x00.\x00e\x00x\x00e\x00"\x00\x00\x00 ValueName => |
SUCCESS | 0x00000000 | |
| 09:18:20,143 | 1640 | RegCloseKey |
Handle => 0x00000366 |
SUCCESS | 0x00000000 | |
| 09:18:20,143 | 1640 | RegCloseKey |
Handle => 0x00000356 |
SUCCESS | 0x00000000 | |
| 09:18:20,143 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CoResumeClassObjects FunctionAddress => 0x77526d50 ModuleHandle => 0x774e0000 |
SUCCESS | 0x00000000 | |
| 09:18:20,143 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:20,143 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002433a0 | |
| 09:18:20,143 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002433a0 | |
| 09:18:20,143 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002433a0 | |
| 09:18:20,143 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:20,143 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:20,143 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000354 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\x90\x8dB\xb6\x8a\xa2\xcf\x01\x90\x8dB\xb6\x8a\xa2\xcf\x01\x90\x8dB\xb6\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:20,143 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:20,143 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002433a0 | |
| 09:18:20,143 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002433a0 | |
| 09:18:20,143 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002433a0 | |
| 09:18:20,143 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:20,143 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:20,143 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000354 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\x90\x8dB\xb6\x8a\xa2\xcf\x01\x90\x8dB\xb6\x8a\xa2\xcf\x01\x90\x8dB\xb6\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:20,243 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x002433a0 | |
| 09:18:20,243 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:20,243 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x002433a0 | |
| 09:18:20,243 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x002433a0 | |
| 09:18:20,243 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x002433a0 | |
| 09:18:20,243 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:20,243 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x002433a0 | |
| 09:18:20,243 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x002433a0 | |
| 09:18:20,243 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:20,243 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:20,243 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\A9R40C5.tmp |
SUCCESS | 4294967295 | |
| 09:18:20,243 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:20,253 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x002433a0 | |
| 09:18:20,253 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:20,253 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x002433a0 | |
| 09:18:20,253 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x002433a0 | |
| 09:18:20,253 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x002433a0 | |
| 09:18:20,253 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:20,253 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:20,253 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:20,253 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x002433a0 | |
| 09:18:20,253 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:20,253 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x002433a0 | |
| 09:18:20,253 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:20,253 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:20,253 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x002433a0 | |
| 09:18:20,263 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:20,263 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x002433a0 | |
| 09:18:20,263 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x002433a0 | |
| 09:18:20,263 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x002433a0 | |
| 09:18:20,263 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:20,263 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:20,263 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:20,263 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x002433a0 | |
| 09:18:20,263 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:20,263 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x002433a0 | |
| 09:18:20,263 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:20,263 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:20,263 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x002433a0 | |
| 09:18:20,263 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:20,263 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x002433a0 | |
| 09:18:20,263 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x002433a0 | |
| 09:18:20,263 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x002433a0 | |
| 09:18:20,263 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:20,263 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:20,263 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:20,263 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x002433a0 | |
| 09:18:20,273 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:20,273 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x002433a0 | |
| 09:18:20,273 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:20,273 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:20,273 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:20,273 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002433a0 | |
| 09:18:20,273 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002433a0 | |
| 09:18:20,273 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002433a0 | |
| 09:18:20,273 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\Security |
SUCCESS | 0x002433a0 | |
| 09:18:20,273 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:20,273 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:20,273 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:20,273 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:20,273 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002433a0 | |
| 09:18:20,273 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:20,273 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:20,273 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:20,273 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002433a0 | |
| 09:18:20,273 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002433a0 | |
| 09:18:20,283 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:20,283 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:20,283 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:20,283 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002433a0 | |
| 09:18:20,283 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002433a0 | |
| 09:18:20,283 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002433a0 | |
| 09:18:20,283 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:20,283 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:20,283 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x002433a0 | |
| 09:18:20,283 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:20,283 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x002433a0 | |
| 09:18:20,283 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x002433a0 | |
| 09:18:20,283 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x002433a0 | |
| 09:18:20,283 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:20,283 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:20,283 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:20,283 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x002433a0 | |
| 09:18:20,283 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:20,293 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x002433a0 | |
| 09:18:20,293 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:20,293 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:20,293 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:20,293 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002433a0 | |
| 09:18:20,293 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002433a0 | |
| 09:18:20,293 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002433a0 | |
| 09:18:20,293 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\Security |
SUCCESS | 0x002433a0 | |
| 09:18:20,293 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:20,293 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:20,293 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:20,293 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:20,293 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002433a0 | |
| 09:18:20,293 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:20,293 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:20,293 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:20,293 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002433a0 | |
| 09:18:20,293 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002433a0 | |
| 09:18:20,293 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:20,293 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:20,303 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:20,303 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002433a0 | |
| 09:18:20,303 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002433a0 | |
| 09:18:20,303 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002433a0 | |
| 09:18:20,303 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:20,303 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:20,303 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x002433a0 | |
| 09:18:20,303 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:20,303 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x002433a0 | |
| 09:18:20,303 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x002433a0 | |
| 09:18:20,303 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x002433a0 | |
| 09:18:20,303 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:20,303 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:20,303 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:20,303 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x002433a0 | |
| 09:18:20,303 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:20,303 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x002433a0 | |
| 09:18:20,303 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:20,303 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:20,313 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x002433a0 | |
| 09:18:20,313 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:20,313 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x002433a0 | |
| 09:18:20,313 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x002433a0 | |
| 09:18:20,313 | 1640 | NtCreateFile |
ShareAccess => 0 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\sep14tax-c8.pdf DesiredAccess => 0x00100080 CreateDisposition => 1 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:20,313 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:20,313 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Temp |
SUCCESS | 0x002433a0 | |
| 09:18:20,313 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:20,313 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Temp |
SUCCESS | 0x002433a0 | |
| 09:18:20,313 | 1640 | NtCreateFile |
ShareAccess => 0 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\sep14tax-c8.pdf DesiredAccess => 0x00100080 CreateDisposition => 1 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:20,313 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:20,313 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Temp |
SUCCESS | 0x002433a0 | |
| 09:18:20,313 | 1640 | RegCreateKeyExW |
Handle => 0x00000354 Access => 131078 Registry => 0x80000001 Class => SubKey => Software\Adobe\Acrobat Reader\11.0\AVGeneral |
SUCCESS | 0x00000000 | |
| 09:18:20,313 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x00000354 SubKey => cRecentFiles |
FAILURE | 0x00000002 | |
| 09:18:20,313 | 1640 | RegCreateKeyExW |
Handle => 0x00000364 Access => 131078 Registry => 0x80000001 Class => SubKey => Software\Adobe\Acrobat Reader\11.0\AVGeneral\cRecentFiles\c1 |
SUCCESS | 0x00000000 | |
| 09:18:20,313 | 1640 | RegSetValueExW |
Handle => 0x00000364 Buffer => D\x00O\x00S\x00\x00\x00 ValueName => aFS Type => 1 |
SUCCESS | 0x00000000 | |
| 09:18:20,323 | 1640 | RegSetValueExW |
Handle => 0x00000364 Buffer => /\x00C\x00/\x00D\x00O\x00C\x00U\x00M\x00E\x00~\x001\x00/\x00T\x00D\x00W\x00/\x00L\x00O\x00C\x00A\x00L\x00S\x00~\x001\x00/\x00T\x00e\x00m\x00p\x00/\x00s\x00e\x00p\x001\x004\x00t\x00a\x00x\x00-\x00c\x008\x00.\x00p\x00d\x00f\x00\x00\x00 ValueName => tDIText Type => 1 |
SUCCESS | 0x00000000 | |
| 09:18:20,323 | 1640 | RegSetValueExW |
Handle => 0x00000364 Buffer => ValueName => sDI Type => 3 |
SUCCESS | 0x00000000 | |
| 09:18:20,323 | 1640 | RegSetValueExW |
Handle => 0x00000364 Buffer => ValueName => sDate Type => 3 |
SUCCESS | 0x00000000 | |
| 09:18:20,323 | 1640 | RegSetValueExW |
Handle => 0x00000364 Buffer => 414252 ValueName => uFileSize Type => 4 |
SUCCESS | 0x00000000 | |
| 09:18:20,323 | 1640 | RegSetValueExW |
Handle => 0x00000364 Buffer => 1 ValueName => uPageCount Type => 4 |
SUCCESS | 0x00000000 | |
| 09:18:20,323 | 1640 | RegCloseKey |
Handle => 0x00000364 |
SUCCESS | 0x00000000 | |
| 09:18:20,323 | 1640 | RegCloseKey |
Handle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:20,323 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x002433a0 | |
| 09:18:20,323 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:20,323 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x002433a0 | |
| 09:18:20,323 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x002433a0 | |
| 09:18:20,323 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:20,323 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:20,323 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x002433a0 | |
| 09:18:20,323 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:20,333 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x002433a0 | |
| 09:18:20,333 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x002433a0 | |
| 09:18:20,333 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:20,333 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:20,333 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:20,333 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:20,333 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:20,333 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:20,774 | 1640 | NtCreateKey |
ObjectAttributes => Software\Adobe\Acrobat Reader\11.0\ServicesRdr DesiredAccess => 196639 KeyHandle => 0x00000364 Class => |
SUCCESS | 0x00000000 | |
| 09:18:20,774 | 1640 | NtCreateKey |
ObjectAttributes => ccom_2E_adobe DesiredAccess => 196639 KeyHandle => 0x00000364 Class => |
SUCCESS | 0x00000000 | |
| 09:18:20,774 | 1640 | NtCreateKey |
ObjectAttributes => ccom_2E_adobe_2E_acrobat_2E_services_2E_DEXShare DesiredAccess => 196639 KeyHandle => 0x00000364 Class => |
SUCCESS | 0x00000000 | |
| 09:18:20,804 | 1640 | NtCreateKey |
ObjectAttributes => cSharePanel DesiredAccess => 196639 KeyHandle => 0x00000364 Class => |
SUCCESS | 0x00000000 | |
| 09:18:20,864 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x002433a0 | |
| 09:18:20,864 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:20,864 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x002433a0 | |
| 09:18:20,864 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x002433a0 | |
| 09:18:20,864 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:20,864 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:20,884 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x002433a0 | |
| 09:18:20,884 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:20,884 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x002433a0 | |
| 09:18:20,884 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x002433a0 | |
| 09:18:20,884 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:20,884 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:20,904 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x002433a0 | |
| 09:18:20,904 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:20,904 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x002433a0 | |
| 09:18:20,904 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x002433a0 | |
| 09:18:20,904 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:20,904 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:21,104 | 1640 | NtOpenKey |
DesiredAccess => 65547 KeyHandle => 0x00000364 ObjectAttributes => Software\Adobe\Adobe Synchronizer\11.0\CredentialsV2 |
SUCCESS | 0x00000000 | |
| 09:18:21,204 | 1640 | NtCreateKey |
ObjectAttributes => Software\Adobe\Acrobat Reader\11.0\ServicesRdr DesiredAccess => 196639 KeyHandle => 0x00000364 Class => |
SUCCESS | 0x00000000 | |
| 09:18:21,214 | 1640 | NtCreateKey |
ObjectAttributes => ccom_2E_adobe DesiredAccess => 196639 KeyHandle => 0x00000364 Class => |
SUCCESS | 0x00000000 | |
| 09:18:21,214 | 1640 | NtCreateKey |
ObjectAttributes => ccom_2E_adobe_2E_acrobat_2E_services_2E_DEXShare DesiredAccess => 196639 KeyHandle => 0x00000364 Class => |
SUCCESS | 0x00000000 | |
| 09:18:21,214 | 1640 | NtCreateKey |
ObjectAttributes => cSharePanel DesiredAccess => 196639 KeyHandle => 0x00000364 Class => |
SUCCESS | 0x00000000 | |
| 09:18:21,234 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:21,234 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002433a0 | |
| 09:18:21,234 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002433a0 | |
| 09:18:21,234 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002433a0 | |
| 09:18:21,234 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:21,234 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:21,234 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000354 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\x90\x8dB\xb6\x8a\xa2\xcf\x01\x90\x8dB\xb6\x8a\xa2\xcf\x01\x90\x8dB\xb6\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:21,234 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:21,234 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002433a0 | |
| 09:18:21,234 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002433a0 | |
| 09:18:21,234 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002433a0 | |
| 09:18:21,234 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:21,234 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:21,234 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000354 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\x90\x8dB\xb6\x8a\xa2\xcf\x01\x90\x8dB\xb6\x8a\xa2\xcf\x01\x90\x8dB\xb6\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:21,234 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:21,234 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002433a0 | |
| 09:18:21,244 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002433a0 | |
| 09:18:21,244 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002433a0 | |
| 09:18:21,244 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:21,244 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:21,244 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000354 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\x90\x8dB\xb6\x8a\xa2\xcf\x01\x90\x8dB\xb6\x8a\xa2\xcf\x01\x90\x8dB\xb6\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:21,244 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:21,244 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002433a0 | |
| 09:18:21,244 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002433a0 | |
| 09:18:21,244 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002433a0 | |
| 09:18:21,244 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:21,244 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:21,244 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000354 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\x90\x8dB\xb6\x8a\xa2\xcf\x01\x90\x8dB\xb6\x8a\xa2\xcf\x01\x90\x8dB\xb6\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:21,254 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:21,254 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002433a0 | |
| 09:18:21,254 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002433a0 | |
| 09:18:21,254 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002433a0 | |
| 09:18:21,254 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:21,254 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:21,254 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000354 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\x90\x8dB\xb6\x8a\xa2\xcf\x01\x90\x8dB\xb6\x8a\xa2\xcf\x01\x90\x8dB\xb6\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:21,254 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:21,254 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002433a0 | |
| 09:18:21,254 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002433a0 | |
| 09:18:21,254 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002433a0 | |
| 09:18:21,254 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:21,254 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:21,254 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000354 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\x90\x8dB\xb6\x8a\xa2\xcf\x01\x90\x8dB\xb6\x8a\xa2\xcf\x01\x90\x8dB\xb6\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:21,254 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:21,254 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002433a0 | |
| 09:18:21,254 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002433a0 | |
| 09:18:21,254 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002433a0 | |
| 09:18:21,254 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:21,254 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:21,254 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000354 FileInformation => \xa0\xb0\x1c\xbf\x8a\xa2\xcf\x01\xa0\xb0\x1c\xbf\x8a\xa2\xcf\x01\xa0\xb0\x1c\xbf\x8a\xa2\xcf\x01\xa0\xb0\x1c\xbf\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\xf6)\x00\x00\x00\x00\x03\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:21,304 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:21,304 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002433a0 | |
| 09:18:21,304 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002433a0 | |
| 09:18:21,304 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002433a0 | |
| 09:18:21,304 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:21,304 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002433a0 | |
| 09:18:21,304 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002433a0 | |
| 09:18:21,304 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002433a0 | |
| 09:18:21,304 | 1640 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:21,304 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:21,304 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:21,304 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002433a0 | |
| 09:18:21,304 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002433a0 | |
| 09:18:21,304 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002433a0 | |
| 09:18:21,304 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:21,304 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:21,304 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000354 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01`\xcd"\xbf\x8a\xa2\xcf\x01`\xcd"\xbf\x8a\xa2\xcf\x01`\xcd"\xbf\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:21,354 | 1640 | NtCreateKey |
ObjectAttributes => Software\Adobe\Acrobat Reader\11.0\ServicesRdr DesiredAccess => 196639 KeyHandle => 0x00000364 Class => |
SUCCESS | 0x00000000 | |
| 09:18:21,364 | 1640 | NtCreateKey |
ObjectAttributes => ccom_2E_adobe DesiredAccess => 196639 KeyHandle => 0x00000364 Class => |
SUCCESS | 0x00000000 | |
| 09:18:21,364 | 1640 | NtCreateKey |
ObjectAttributes => ccom_2E_adobe_2E_acrobat_2E_services_2E_DEXShare DesiredAccess => 196639 KeyHandle => 0x00000364 Class => |
SUCCESS | 0x00000000 | |
| 09:18:21,364 | 1640 | NtCreateKey |
ObjectAttributes => cSharePanel DesiredAccess => 196639 KeyHandle => 0x00000364 Class => |
SUCCESS | 0x00000000 | |
| 09:18:21,915 | 1640 | FindFirstFileExW |
FileName => C:\WINDOWS |
SUCCESS | 0x002433a0 | |
| 09:18:21,915 | 1640 | FindFirstFileExW |
FileName => C:\WINDOWS\system32 |
SUCCESS | 0x002433a0 | |
| 09:18:21,915 | 1640 | FindFirstFileExW |
FileName => C:\WINDOWS\system32\shell32.dll |
SUCCESS | 0x002433a0 | |
| 09:18:21,915 | 1640 | FindFirstFileExW |
FileName => C:\WINDOWS |
SUCCESS | 0x002433a0 | |
| 09:18:21,915 | 1640 | FindFirstFileExW |
FileName => C:\WINDOWS\system32 |
SUCCESS | 0x002433a0 | |
| 09:18:21,915 | 1640 | FindFirstFileExW |
FileName => C:\WINDOWS\system32\shell32.dll |
SUCCESS | 0x002433a0 | |
| 09:18:21,915 | 1640 | FindFirstFileExW |
FileName => C:\WINDOWS |
SUCCESS | 0x002433a0 | |
| 09:18:21,915 | 1640 | FindFirstFileExW |
FileName => C:\WINDOWS\system32 |
SUCCESS | 0x002433a0 | |
| 09:18:21,925 | 1640 | FindFirstFileExW |
FileName => C:\WINDOWS\system32\shell32.dll |
SUCCESS | 0x002433a0 | |
| 09:18:21,925 | 1640 | FindFirstFileExW |
FileName => C:\WINDOWS |
SUCCESS | 0x002433a0 | |
| 09:18:21,925 | 1640 | FindFirstFileExW |
FileName => C:\WINDOWS\system32 |
SUCCESS | 0x002433a0 | |
| 09:18:21,925 | 1640 | FindFirstFileExW |
FileName => C:\WINDOWS\system32\shell32.dll |
SUCCESS | 0x002433a0 | |
| 09:18:21,935 | 1640 | FindFirstFileExW |
FileName => C:\WINDOWS |
SUCCESS | 0x002433a0 | 3 times |
| 09:18:22,005 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,005 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002433a0 | |
| 09:18:22,005 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002433a0 | |
| 09:18:22,005 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002433a0 | |
| 09:18:22,005 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,005 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,005 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000354 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\x90T$\xbf\x8a\xa2\xcf\x01`\xcd"\xbf\x8a\xa2\xcf\x01`\xcd"\xbf\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:22,005 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,005 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002433a0 | |
| 09:18:22,005 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002433a0 | |
| 09:18:22,015 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002433a0 | |
| 09:18:22,015 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,015 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,015 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000354 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\x90T$\xbf\x8a\xa2\xcf\x01`\xcd"\xbf\x8a\xa2\xcf\x01`\xcd"\xbf\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:22,015 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,015 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002433a0 | |
| 09:18:22,015 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002433a0 | |
| 09:18:22,015 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002433a0 | |
| 09:18:22,015 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,015 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,015 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000354 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\xe0\xd2\x90\xbf\x8a\xa2\xcf\x01`\xcd"\xbf\x8a\xa2\xcf\x01`\xcd"\xbf\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:22,025 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,025 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002433a0 | |
| 09:18:22,025 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002433a0 | |
| 09:18:22,025 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002433a0 | |
| 09:18:22,025 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,025 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,025 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000354 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\xe0\xd2\x90\xbf\x8a\xa2\xcf\x01`\xcd"\xbf\x8a\xa2\xcf\x01`\xcd"\xbf\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:22,025 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,025 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002433a0 | |
| 09:18:22,025 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002433a0 | |
| 09:18:22,025 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002433a0 | |
| 09:18:22,025 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,025 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,035 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000354 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\xe0\xd2\x90\xbf\x8a\xa2\xcf\x01`\xcd"\xbf\x8a\xa2\xcf\x01`\xcd"\xbf\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:22,035 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,035 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002433a0 | |
| 09:18:22,035 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002433a0 | |
| 09:18:22,035 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002433a0 | |
| 09:18:22,035 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,035 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,035 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000354 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01@\xe1\x93\xbf\x8a\xa2\xcf\x01`\xcd"\xbf\x8a\xa2\xcf\x01`\xcd"\xbf\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:22,045 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,045 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002433a0 | |
| 09:18:22,045 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002433a0 | |
| 09:18:22,045 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002433a0 | |
| 09:18:22,045 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,045 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,045 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000354 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01@\xe1\x93\xbf\x8a\xa2\xcf\x01`\xcd"\xbf\x8a\xa2\xcf\x01`\xcd"\xbf\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:22,045 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,045 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002433a0 | |
| 09:18:22,045 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002433a0 | |
| 09:18:22,045 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002433a0 | |
| 09:18:22,045 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,045 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,045 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000354 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01@\xe1\x93\xbf\x8a\xa2\xcf\x01`\xcd"\xbf\x8a\xa2\xcf\x01`\xcd"\xbf\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:22,045 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,045 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002433a0 | |
| 09:18:22,045 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002433a0 | |
| 09:18:22,045 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002433a0 | |
| 09:18:22,045 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,045 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,045 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000354 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01ph\x95\xbf\x8a\xa2\xcf\x01`\xcd"\xbf\x8a\xa2\xcf\x01`\xcd"\xbf\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:22,055 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,055 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002433a0 | |
| 09:18:22,055 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002433a0 | |
| 09:18:22,055 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002433a0 | |
| 09:18:22,055 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,055 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,055 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000354 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\xa0\xef\x96\xbf\x8a\xa2\xcf\x01`\xcd"\xbf\x8a\xa2\xcf\x01`\xcd"\xbf\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:22,065 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,065 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002433a0 | |
| 09:18:22,065 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002433a0 | |
| 09:18:22,065 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002433a0 | |
| 09:18:22,065 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,065 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,065 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000354 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\xa0\xef\x96\xbf\x8a\xa2\xcf\x01`\xcd"\xbf\x8a\xa2\xcf\x01`\xcd"\xbf\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:22,065 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,065 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002433a0 | |
| 09:18:22,065 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002433a0 | |
| 09:18:22,065 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002433a0 | |
| 09:18:22,065 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,065 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,065 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000354 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\xd0v\x98\xbf\x8a\xa2\xcf\x01`\xcd"\xbf\x8a\xa2\xcf\x01`\xcd"\xbf\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:22,085 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,085 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002433a0 | |
| 09:18:22,085 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002433a0 | |
| 09:18:22,085 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002433a0 | |
| 09:18:22,085 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,085 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,085 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000354 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\x00\xfe\x99\xbf\x8a\xa2\xcf\x01`\xcd"\xbf\x8a\xa2\xcf\x01`\xcd"\xbf\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:22,085 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,085 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002433a0 | |
| 09:18:22,085 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002433a0 | |
| 09:18:22,095 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002433a0 | |
| 09:18:22,095 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,095 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,095 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000354 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\x00\xfe\x99\xbf\x8a\xa2\xcf\x01`\xcd"\xbf\x8a\xa2\xcf\x01`\xcd"\xbf\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:22,095 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,095 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002433a0 | |
| 09:18:22,095 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002433a0 | |
| 09:18:22,095 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002433a0 | |
| 09:18:22,095 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,095 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,095 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000354 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01`\x0c\x9d\xbf\x8a\xa2\xcf\x01`\xcd"\xbf\x8a\xa2\xcf\x01`\xcd"\xbf\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:22,105 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,105 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002433a0 | |
| 09:18:22,105 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002433a0 | |
| 09:18:22,105 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002433a0 | |
| 09:18:22,105 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,105 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,105 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000354 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01`\x0c\x9d\xbf\x8a\xa2\xcf\x01`\xcd"\xbf\x8a\xa2\xcf\x01`\xcd"\xbf\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:22,146 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,146 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002433a0 | |
| 09:18:22,146 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002433a0 | |
| 09:18:22,146 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002433a0 | |
| 09:18:22,146 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,146 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,146 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000354 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01`\x0c\x9d\xbf\x8a\xa2\xcf\x01`\xcd"\xbf\x8a\xa2\xcf\x01`\xcd"\xbf\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:22,146 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,146 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002433a0 | |
| 09:18:22,146 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002433a0 | |
| 09:18:22,146 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002433a0 | |
| 09:18:22,146 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,176 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,176 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000354 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01P\xb0\xa4\xbf\x8a\xa2\xcf\x01`\xcd"\xbf\x8a\xa2\xcf\x01`\xcd"\xbf\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:22,186 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,186 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002433a0 | |
| 09:18:22,186 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002433a0 | |
| 09:18:22,186 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002433a0 | |
| 09:18:22,186 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,186 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,186 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000354 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\xe0E\xa9\xbf\x8a\xa2\xcf\x01`\xcd"\xbf\x8a\xa2\xcf\x01`\xcd"\xbf\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:22,186 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,186 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002433a0 | |
| 09:18:22,186 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002433a0 | |
| 09:18:22,186 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002433a0 | |
| 09:18:22,186 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,186 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,186 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000354 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\xe0E\xa9\xbf\x8a\xa2\xcf\x01`\xcd"\xbf\x8a\xa2\xcf\x01`\xcd"\xbf\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:22,196 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,196 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002433a0 | |
| 09:18:22,196 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002433a0 | |
| 09:18:22,196 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002433a0 | |
| 09:18:22,196 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,196 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,196 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000354 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01@T\xac\xbf\x8a\xa2\xcf\x01`\xcd"\xbf\x8a\xa2\xcf\x01`\xcd"\xbf\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:22,236 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,236 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002433a0 | |
| 09:18:22,236 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002433a0 | |
| 09:18:22,236 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002433a0 | |
| 09:18:22,236 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,236 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,236 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000354 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01@T\xac\xbf\x8a\xa2\xcf\x01`\xcd"\xbf\x8a\xa2\xcf\x01`\xcd"\xbf\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:22,276 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,276 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002433a0 | |
| 09:18:22,276 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002433a0 | |
| 09:18:22,276 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002433a0 | |
| 09:18:22,276 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,276 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,276 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000354 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\x00q\xb2\xbf\x8a\xa2\xcf\x01`\xcd"\xbf\x8a\xa2\xcf\x01`\xcd"\xbf\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:22,276 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,276 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002433a0 | |
| 09:18:22,276 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002433a0 | |
| 09:18:22,276 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002433a0 | |
| 09:18:22,276 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,276 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,276 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000354 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\xc0\x8d\xb8\xbf\x8a\xa2\xcf\x01`\xcd"\xbf\x8a\xa2\xcf\x01`\xcd"\xbf\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:22,286 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,286 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002433a0 | |
| 09:18:22,286 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002433a0 | |
| 09:18:22,286 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002433a0 | |
| 09:18:22,286 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,286 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,286 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000354 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\xc0\x8d\xb8\xbf\x8a\xa2\xcf\x01`\xcd"\xbf\x8a\xa2\xcf\x01`\xcd"\xbf\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:22,326 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,326 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002433a0 | |
| 09:18:22,326 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002433a0 | |
| 09:18:22,326 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002433a0 | |
| 09:18:22,326 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,326 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,326 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000354 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01P#\xbd\xbf\x8a\xa2\xcf\x01`\xcd"\xbf\x8a\xa2\xcf\x01`\xcd"\xbf\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:22,416 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,416 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,416 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,416 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x002433a0 | |
| 09:18:22,416 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files DesiredAccess => 0x00100001 CreateDisposition => 2 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,416 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,416 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,416 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,416 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,416 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x002433a0 | |
| 09:18:22,416 | 1640 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files DesiredAccess => 0x00100100 CreateDisposition => 1 FileHandle => 0x00000000 |
FAILURE | 3221225658 | |
| 09:18:22,416 | 1640 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files DesiredAccess => 0x00100000 CreateDisposition => 1 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,416 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,416 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,416 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,416 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,416 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x002433a0 | |
| 09:18:22,416 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\ DesiredAccess => 0x00100001 CreateDisposition => 2 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,416 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,416 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,416 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,416 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,416 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x002433a0 | |
| 09:18:22,416 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x002433a0 | |
| 09:18:22,426 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\index.dat DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,426 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,426 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000354 FileInformation => \x90y\xcf\xbf\x8a\xa2\xcf\x01\x90y\xcf\xbf\x8a\xa2\xcf\x01\x90y\xcf\xbf\x8a\xa2\xcf\x01\x90y\xcf\xbf\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00IL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xd6\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:22,426 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,426 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,426 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,426 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x002433a0 | |
| 09:18:22,426 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x002433a0 | |
| 09:18:22,426 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\index.dat |
SUCCESS | 0x002433a0 | |
| 09:18:22,426 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\index.dat DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,426 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,426 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000354 FileInformation => \x90y\xcf\xbf\x8a\xa2\xcf\x01\x90y\xcf\xbf\x8a\xa2\xcf\x01\xe0\x06g\xb8\x8a\xa2\xcf\x01\x90y\xcf\xbf\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00IL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xd6\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:22,426 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,426 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,426 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,426 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x002433a0 | |
| 09:18:22,426 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x002433a0 | |
| 09:18:22,426 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,426 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,426 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,426 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x002433a0 | |
| 09:18:22,426 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x002433a0 | |
| 09:18:22,426 | 1640 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\ DesiredAccess => 0x00100100 CreateDisposition => 1 FileHandle => 0x00000000 |
FAILURE | 3221225658 | |
| 09:18:22,426 | 1640 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\ DesiredAccess => 0x00100000 CreateDisposition => 1 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,426 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,426 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,426 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,426 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,426 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x002433a0 | |
| 09:18:22,426 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x002433a0 | |
| 09:18:22,426 | 1640 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\desktop.ini DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,426 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,426 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000354 FileInformation => \x90y\xcf\xbf\x8a\xa2\xcf\x01\x90y\xcf\xbf\x8a\xa2\xcf\x01\x90y\xcf\xbf\x8a\xa2\xcf\x01\x90y\xcf\xbf\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00JL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xda\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:22,436 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,436 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,436 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,436 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x002433a0 | |
| 09:18:22,436 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x002433a0 | |
| 09:18:22,436 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\desktop.ini |
SUCCESS | 0x002433a0 | |
| 09:18:22,436 | 1640 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\desktop.ini DesiredAccess => 0x00100100 CreateDisposition => 1 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,436 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,436 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000354 FileInformation => \x00\xe9\x90|`G9\x000O9\x00|\xd8\x90|\xea\x82 |
FAILURE | 3221225506 | |
| 09:18:22,436 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,436 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,436 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,436 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x002433a0 | |
| 09:18:22,436 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x002433a0 | |
| 09:18:22,436 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\QBAUBVMU DesiredAccess => 0x00100001 CreateDisposition => 2 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,436 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,436 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,436 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,436 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,436 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x002433a0 | |
| 09:18:22,436 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x002433a0 | |
| 09:18:22,436 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\QBAUBVMU |
SUCCESS | 0x002433a0 | |
| 09:18:22,436 | 1640 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\QBAUBVMU DesiredAccess => 0x00100100 CreateDisposition => 1 FileHandle => 0x00000000 |
FAILURE | 3221225658 | |
| 09:18:22,436 | 1640 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\QBAUBVMU DesiredAccess => 0x00100000 CreateDisposition => 1 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,436 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,436 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,436 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,436 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,436 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x002433a0 | |
| 09:18:22,436 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x002433a0 | |
| 09:18:22,436 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\QBAUBVMU |
SUCCESS | 0x002433a0 | |
| 09:18:22,436 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,436 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,436 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,436 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x002433a0 | |
| 09:18:22,436 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x002433a0 | |
| 09:18:22,436 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\QBAUBVMU |
SUCCESS | 0x002433a0 | |
| 09:18:22,436 | 1640 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\QBAUBVMU DesiredAccess => 0x00100100 CreateDisposition => 1 FileHandle => 0x00000000 |
FAILURE | 3221225658 | |
| 09:18:22,436 | 1640 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\QBAUBVMU DesiredAccess => 0x00100000 CreateDisposition => 1 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,436 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,436 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,436 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,436 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,436 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x002433a0 | |
| 09:18:22,436 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x002433a0 | |
| 09:18:22,436 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\QBAUBVMU |
SUCCESS | 0x002433a0 | |
| 09:18:22,446 | 1640 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\QBAUBVMU\desktop.ini DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,446 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,446 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000354 FileInformation => \xf0\x87\xd2\xbf\x8a\xa2\xcf\x01\xf0\x87\xd2\xbf\x8a\xa2\xcf\x01\xf0\x87\xd2\xbf\x8a\xa2\xcf\x01\xf0\x87\xd2\xbf\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00LL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xec\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:22,446 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,446 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,446 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,446 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x002433a0 | |
| 09:18:22,446 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x002433a0 | |
| 09:18:22,446 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\QBAUBVMU |
SUCCESS | 0x002433a0 | |
| 09:18:22,446 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\QBAUBVMU\desktop.ini |
SUCCESS | 0x002433a0 | |
| 09:18:22,446 | 1640 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\QBAUBVMU\desktop.ini DesiredAccess => 0x00100100 CreateDisposition => 1 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,446 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,446 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000354 FileInformation => \x00\xe9\x90|`G9\x000O9\x00|\xd8\x90|\xea\x82 |
FAILURE | 3221225506 | |
| 09:18:22,446 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,446 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,446 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,446 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x002433a0 | |
| 09:18:22,446 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x002433a0 | |
| 09:18:22,446 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\70171OGX DesiredAccess => 0x00100001 CreateDisposition => 2 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,446 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,446 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,446 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,446 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,446 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x002433a0 | |
| 09:18:22,446 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x002433a0 | |
| 09:18:22,446 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\70171OGX |
SUCCESS | 0x002433a0 | |
| 09:18:22,456 | 1640 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\70171OGX DesiredAccess => 0x00100100 CreateDisposition => 1 FileHandle => 0x00000000 |
FAILURE | 3221225658 | |
| 09:18:22,456 | 1640 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\70171OGX DesiredAccess => 0x00100000 CreateDisposition => 1 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,456 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,456 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,456 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,456 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,456 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x002433a0 | |
| 09:18:22,456 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x002433a0 | |
| 09:18:22,456 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\70171OGX |
SUCCESS | 0x002433a0 | |
| 09:18:22,456 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,456 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,456 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,456 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x002433a0 | |
| 09:18:22,456 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x002433a0 | |
| 09:18:22,456 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\70171OGX |
SUCCESS | 0x002433a0 | |
| 09:18:22,456 | 1640 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\70171OGX DesiredAccess => 0x00100100 CreateDisposition => 1 FileHandle => 0x00000000 |
FAILURE | 3221225658 | |
| 09:18:22,456 | 1640 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\70171OGX DesiredAccess => 0x00100000 CreateDisposition => 1 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,456 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,456 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,466 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,466 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,466 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x002433a0 | |
| 09:18:22,466 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x002433a0 | |
| 09:18:22,466 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\70171OGX |
SUCCESS | 0x002433a0 | |
| 09:18:22,466 | 1640 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\70171OGX\desktop.ini DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,466 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,466 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000354 FileInformation => P\x96\xd5\xbf\x8a\xa2\xcf\x01P\x96\xd5\xbf\x8a\xa2\xcf\x01P\x96\xd5\xbf\x8a\xa2\xcf\x01P\x96\xd5\xbf\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00NL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xec\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:22,466 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,466 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,466 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,466 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x002433a0 | |
| 09:18:22,466 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x002433a0 | |
| 09:18:22,466 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\70171OGX |
SUCCESS | 0x002433a0 | |
| 09:18:22,466 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\70171OGX\desktop.ini |
SUCCESS | 0x002433a0 | |
| 09:18:22,466 | 1640 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\70171OGX\desktop.ini DesiredAccess => 0x00100100 CreateDisposition => 1 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,466 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,466 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000354 FileInformation => \x00\xe9\x90|`G9\x000O9\x00|\xd8\x90|\xea\x82 |
FAILURE | 3221225506 | |
| 09:18:22,466 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,476 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,476 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,476 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x002433a0 | |
| 09:18:22,476 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x002433a0 | |
| 09:18:22,476 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\0523LVRI DesiredAccess => 0x00100001 CreateDisposition => 2 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,476 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,476 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,476 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,476 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,476 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x002433a0 | |
| 09:18:22,476 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x002433a0 | |
| 09:18:22,476 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\0523LVRI |
SUCCESS | 0x002433a0 | |
| 09:18:22,476 | 1640 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\0523LVRI DesiredAccess => 0x00100100 CreateDisposition => 1 FileHandle => 0x00000000 |
FAILURE | 3221225658 | |
| 09:18:22,476 | 1640 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\0523LVRI DesiredAccess => 0x00100000 CreateDisposition => 1 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,476 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,476 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,476 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,476 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,476 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x002433a0 | |
| 09:18:22,476 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x002433a0 | |
| 09:18:22,476 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\0523LVRI |
SUCCESS | 0x002433a0 | |
| 09:18:22,476 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,486 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,486 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,486 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x002433a0 | |
| 09:18:22,486 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x002433a0 | |
| 09:18:22,486 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\0523LVRI |
SUCCESS | 0x002433a0 | |
| 09:18:22,486 | 1640 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\0523LVRI DesiredAccess => 0x00100100 CreateDisposition => 1 FileHandle => 0x00000000 |
FAILURE | 3221225658 | |
| 09:18:22,486 | 1640 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\0523LVRI DesiredAccess => 0x00100000 CreateDisposition => 1 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,486 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,486 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,486 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,486 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,486 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x002433a0 | |
| 09:18:22,486 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x002433a0 | |
| 09:18:22,486 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\0523LVRI |
SUCCESS | 0x002433a0 | |
| 09:18:22,486 | 1640 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\0523LVRI\desktop.ini DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,486 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,486 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000354 FileInformation => \xb0\xa4\xd8\xbf\x8a\xa2\xcf\x01\xb0\xa4\xd8\xbf\x8a\xa2\xcf\x01\xb0\xa4\xd8\xbf\x8a\xa2\xcf\x01\xb0\xa4\xd8\xbf\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00PL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xec\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:22,496 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,496 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,496 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,496 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x002433a0 | |
| 09:18:22,496 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x002433a0 | |
| 09:18:22,496 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\0523LVRI |
SUCCESS | 0x002433a0 | |
| 09:18:22,496 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\0523LVRI\desktop.ini |
SUCCESS | 0x002433a0 | |
| 09:18:22,496 | 1640 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\0523LVRI\desktop.ini DesiredAccess => 0x00100100 CreateDisposition => 1 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,496 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,496 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000354 FileInformation => \x00\xe9\x90|`G9\x000O9\x00|\xd8\x90|\xea\x82 |
FAILURE | 3221225506 | |
| 09:18:22,496 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,496 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,496 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,496 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x002433a0 | |
| 09:18:22,496 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x002433a0 | |
| 09:18:22,496 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\PK1GFI2J DesiredAccess => 0x00100001 CreateDisposition => 2 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,496 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,496 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,506 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,506 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,506 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x002433a0 | |
| 09:18:22,506 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x002433a0 | |
| 09:18:22,506 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\PK1GFI2J |
SUCCESS | 0x002433a0 | |
| 09:18:22,506 | 1640 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\PK1GFI2J DesiredAccess => 0x00100100 CreateDisposition => 1 FileHandle => 0x00000000 |
FAILURE | 3221225658 | |
| 09:18:22,506 | 1640 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\PK1GFI2J DesiredAccess => 0x00100000 CreateDisposition => 1 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,506 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,506 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,506 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,506 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,506 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x002433a0 | |
| 09:18:22,506 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x002433a0 | |
| 09:18:22,506 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\PK1GFI2J |
SUCCESS | 0x002433a0 | |
| 09:18:22,506 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,506 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,506 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,506 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x002433a0 | |
| 09:18:22,506 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x002433a0 | |
| 09:18:22,506 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\PK1GFI2J |
SUCCESS | 0x002433a0 | |
| 09:18:22,506 | 1640 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\PK1GFI2J DesiredAccess => 0x00100100 CreateDisposition => 1 FileHandle => 0x00000000 |
FAILURE | 3221225658 | |
| 09:18:22,506 | 1640 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\PK1GFI2J DesiredAccess => 0x00100000 CreateDisposition => 1 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,506 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,516 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,516 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,516 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,516 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x002433a0 | |
| 09:18:22,516 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x002433a0 | |
| 09:18:22,516 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\PK1GFI2J |
SUCCESS | 0x002433a0 | |
| 09:18:22,516 | 1640 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\PK1GFI2J\desktop.ini DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,516 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,516 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000354 FileInformation => @:\xdd\xbf\x8a\xa2\xcf\x01@:\xdd\xbf\x8a\xa2\xcf\x01@:\xdd\xbf\x8a\xa2\xcf\x01@:\xdd\xbf\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00RL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xec\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:22,516 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,516 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,516 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,516 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x002433a0 | |
| 09:18:22,516 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x002433a0 | |
| 09:18:22,516 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\PK1GFI2J |
SUCCESS | 0x002433a0 | |
| 09:18:22,516 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\PK1GFI2J\desktop.ini |
SUCCESS | 0x002433a0 | |
| 09:18:22,516 | 1640 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\PK1GFI2J\desktop.ini DesiredAccess => 0x00100100 CreateDisposition => 1 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,516 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,516 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000354 FileInformation => \x00\xe9\x90|`G9\x000O9\x00|\xd8\x90|\xea\x82 |
FAILURE | 3221225506 | |
| 09:18:22,516 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,516 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,516 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,516 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x002433a0 | |
| 09:18:22,516 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x002433a0 | |
| 09:18:22,516 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,516 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,516 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,516 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,516 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,516 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x002433a0 | |
| 09:18:22,516 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x002433a0 | |
| 09:18:22,516 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\0523LVRI |
SUCCESS | 0x002433a0 | |
| 09:18:22,516 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\0523LVRI\desktop.ini |
SUCCESS | 0x002433a0 | |
| 09:18:22,526 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,526 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,526 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,526 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x002433a0 | |
| 09:18:22,526 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x002433a0 | |
| 09:18:22,526 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\0523LVRI |
SUCCESS | 0x002433a0 | |
| 09:18:22,526 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\0523LVRI\desktop.ini |
SUCCESS | 0x002433a0 | |
| 09:18:22,526 | 1640 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\0523LVRI\desktop.ini DesiredAccess => 0x00120089 CreateDisposition => 1 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,526 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,526 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000354 FileInformation => \xb0\xa4\xd8\xbf\x8a\xa2\xcf\x01\xb0\xa4\xd8\xbf\x8a\xa2\xcf\x01\xb0\xa4\xd8\xbf\x8a\xa2\xcf\x01\xe0+\xda\xbf\x8a\xa2\xcf\x01\x06\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x00C\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00PL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x89\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xec\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:22,526 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,526 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,526 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,526 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x002433a0 | |
| 09:18:22,526 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x002433a0 | |
| 09:18:22,526 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\70171OGX |
SUCCESS | 0x002433a0 | |
| 09:18:22,526 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\70171OGX\desktop.ini |
SUCCESS | 0x002433a0 | |
| 09:18:22,526 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,526 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,526 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,526 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x002433a0 | |
| 09:18:22,526 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x002433a0 | |
| 09:18:22,536 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\70171OGX |
SUCCESS | 0x002433a0 | |
| 09:18:22,536 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\70171OGX\desktop.ini |
SUCCESS | 0x002433a0 | |
| 09:18:22,536 | 1640 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\70171OGX\desktop.ini DesiredAccess => 0x00120089 CreateDisposition => 1 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,536 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,536 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000354 FileInformation => P\x96\xd5\xbf\x8a\xa2\xcf\x01P\x96\xd5\xbf\x8a\xa2\xcf\x01P\x96\xd5\xbf\x8a\xa2\xcf\x01P\x96\xd5\xbf\x8a\xa2\xcf\x01\x06\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x00C\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00NL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x89\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xec\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:22,536 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,536 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,536 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,536 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x002433a0 | |
| 09:18:22,536 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x002433a0 | |
| 09:18:22,536 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\PK1GFI2J |
SUCCESS | 0x002433a0 | |
| 09:18:22,536 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\PK1GFI2J\desktop.ini |
SUCCESS | 0x002433a0 | |
| 09:18:22,536 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,536 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,536 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,536 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x002433a0 | |
| 09:18:22,536 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x002433a0 | |
| 09:18:22,536 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\PK1GFI2J |
SUCCESS | 0x002433a0 | |
| 09:18:22,536 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\PK1GFI2J\desktop.ini |
SUCCESS | 0x002433a0 | |
| 09:18:22,536 | 1640 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\PK1GFI2J\desktop.ini DesiredAccess => 0x00120089 CreateDisposition => 1 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,546 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,546 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000354 FileInformation => @:\xdd\xbf\x8a\xa2\xcf\x01@:\xdd\xbf\x8a\xa2\xcf\x01@:\xdd\xbf\x8a\xa2\xcf\x01@:\xdd\xbf\x8a\xa2\xcf\x01\x06\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x00C\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00RL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x89\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xec\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:22,546 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,546 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,546 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,546 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x002433a0 | |
| 09:18:22,546 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x002433a0 | |
| 09:18:22,546 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\QBAUBVMU |
SUCCESS | 0x002433a0 | |
| 09:18:22,546 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\QBAUBVMU\desktop.ini |
SUCCESS | 0x002433a0 | |
| 09:18:22,546 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,546 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,546 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,546 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x002433a0 | |
| 09:18:22,546 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x002433a0 | |
| 09:18:22,546 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\QBAUBVMU |
SUCCESS | 0x002433a0 | |
| 09:18:22,546 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\QBAUBVMU\desktop.ini |
SUCCESS | 0x002433a0 | |
| 09:18:22,546 | 1640 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\QBAUBVMU\desktop.ini DesiredAccess => 0x00120089 CreateDisposition => 1 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,546 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,546 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000354 FileInformation => \xf0\x87\xd2\xbf\x8a\xa2\xcf\x01\xf0\x87\xd2\xbf\x8a\xa2\xcf\x01\xf0\x87\xd2\xbf\x8a\xa2\xcf\x01\xf0\x87\xd2\xbf\x8a\xa2\xcf\x01\x06\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x00C\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00LL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x89\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xec\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:22,546 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,546 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,546 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,546 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x002433a0 | |
| 09:18:22,546 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Cookies\ DesiredAccess => 0x00100001 CreateDisposition => 2 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,546 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,546 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,546 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,546 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,546 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x002433a0 | |
| 09:18:22,546 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Cookies |
SUCCESS | 0x002433a0 | |
| 09:18:22,546 | 1640 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Cookies\ DesiredAccess => 0x00100100 CreateDisposition => 1 FileHandle => 0x00000000 |
FAILURE | 3221225658 | |
| 09:18:22,546 | 1640 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Cookies\ DesiredAccess => 0x00100000 CreateDisposition => 1 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,546 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,546 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,546 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,546 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,546 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x002433a0 | |
| 09:18:22,546 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Cookies |
SUCCESS | 0x002433a0 | |
| 09:18:22,556 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Cookies\index.dat DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,556 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,556 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000354 FileInformation => \x00W\xe3\xbf\x8a\xa2\xcf\x01\x00W\xe3\xbf\x8a\xa2\xcf\x01\x00W\xe3\xbf\x8a\xa2\xcf\x01\x00W\xe3\xbf\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00TL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:22,556 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,556 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,556 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,556 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x002433a0 | |
| 09:18:22,556 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Cookies |
SUCCESS | 0x002433a0 | |
| 09:18:22,556 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Cookies\index.dat |
SUCCESS | 0x002433a0 | |
| 09:18:22,556 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Cookies\index.dat DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,556 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,556 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000354 FileInformation => \x00W\xe3\xbf\x8a\xa2\xcf\x01\x00W\xe3\xbf\x8a\xa2\xcf\x01\xe0\x06g\xb8\x8a\xa2\xcf\x01\x00W\xe3\xbf\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00TL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:22,556 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,556 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,556 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,556 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x002433a0 | |
| 09:18:22,556 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Cookies |
SUCCESS | 0x002433a0 | |
| 09:18:22,556 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Cookies\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,556 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,556 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,556 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,556 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,556 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x002433a0 | |
| 09:18:22,556 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\History DesiredAccess => 0x00100001 CreateDisposition => 2 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,556 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,556 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,556 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,556 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,556 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x002433a0 | |
| 09:18:22,566 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\History |
SUCCESS | 0x002433a0 | |
| 09:18:22,566 | 1640 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\History DesiredAccess => 0x00100100 CreateDisposition => 1 FileHandle => 0x00000000 |
FAILURE | 3221225658 | |
| 09:18:22,566 | 1640 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\History DesiredAccess => 0x00100000 CreateDisposition => 1 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,566 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,566 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,566 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,566 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,566 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x002433a0 | |
| 09:18:22,566 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\History |
SUCCESS | 0x002433a0 | |
| 09:18:22,566 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\History\History.IE5\ DesiredAccess => 0x00100001 CreateDisposition => 2 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,566 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,566 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,566 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,566 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,566 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x002433a0 | |
| 09:18:22,566 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\History |
SUCCESS | 0x002433a0 | |
| 09:18:22,566 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\History\History.IE5 |
SUCCESS | 0x002433a0 | |
| 09:18:22,566 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\History\History.IE5\index.dat DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,566 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,566 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000354 FileInformation => 0\xde\xe4\xbf\x8a\xa2\xcf\x010\xde\xe4\xbf\x8a\xa2\xcf\x010\xde\xe4\xbf\x8a\xa2\xcf\x010\xde\xe4\xbf\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00WL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xb4\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:22,566 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,566 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,566 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,566 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x002433a0 | |
| 09:18:22,566 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\History |
SUCCESS | 0x002433a0 | |
| 09:18:22,566 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\History\History.IE5 |
SUCCESS | 0x002433a0 | |
| 09:18:22,566 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\History\History.IE5\index.dat |
SUCCESS | 0x002433a0 | |
| 09:18:22,566 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\History\History.IE5\index.dat DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,566 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,566 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000354 FileInformation => 0\xde\xe4\xbf\x8a\xa2\xcf\x010\xde\xe4\xbf\x8a\xa2\xcf\x01\xe0\x06g\xb8\x8a\xa2\xcf\x010\xde\xe4\xbf\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00WL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xb4\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:22,576 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,576 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,576 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,576 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x002433a0 | |
| 09:18:22,576 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x002433a0 | |
| 09:18:22,576 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,576 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,576 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,576 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x002433a0 | |
| 09:18:22,576 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x002433a0 | |
| 09:18:22,576 | 1640 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\ DesiredAccess => 0x00100100 CreateDisposition => 1 FileHandle => 0x00000000 |
FAILURE | 3221225658 | |
| 09:18:22,576 | 1640 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\ DesiredAccess => 0x00100000 CreateDisposition => 1 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,576 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,576 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,576 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,576 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,576 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x002433a0 | |
| 09:18:22,576 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x002433a0 | |
| 09:18:22,576 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\desktop.ini |
SUCCESS | 0x002433a0 | |
| 09:18:22,576 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,586 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,586 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,586 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x002433a0 | |
| 09:18:22,586 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\History |
SUCCESS | 0x002433a0 | |
| 09:18:22,586 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\History\History.IE5 |
SUCCESS | 0x002433a0 | |
| 09:18:22,586 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,586 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,586 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,586 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x002433a0 | |
| 09:18:22,586 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\History |
SUCCESS | 0x002433a0 | |
| 09:18:22,586 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\History\History.IE5 |
SUCCESS | 0x002433a0 | |
| 09:18:22,586 | 1640 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\History\History.IE5\ DesiredAccess => 0x00100100 CreateDisposition => 1 FileHandle => 0x00000000 |
FAILURE | 3221225658 | |
| 09:18:22,586 | 1640 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\History\History.IE5\ DesiredAccess => 0x00100000 CreateDisposition => 1 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,586 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,586 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,586 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,586 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,586 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x002433a0 | |
| 09:18:22,586 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\History |
SUCCESS | 0x002433a0 | |
| 09:18:22,586 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\History\History.IE5 |
SUCCESS | 0x002433a0 | |
| 09:18:22,596 | 1640 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\History\History.IE5\desktop.ini DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,596 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,596 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000354 FileInformation => \xc0s\xe9\xbf\x8a\xa2\xcf\x01\xc0s\xe9\xbf\x8a\xa2\xcf\x01\xc0s\xe9\xbf\x8a\xa2\xcf\x01\xc0s\xe9\xbf\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00XL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xb8\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:22,596 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,596 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,596 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,596 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x002433a0 | |
| 09:18:22,596 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\History |
SUCCESS | 0x002433a0 | |
| 09:18:22,596 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\History\History.IE5 |
SUCCESS | 0x002433a0 | |
| 09:18:22,596 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\History\History.IE5\desktop.ini |
SUCCESS | 0x002433a0 | |
| 09:18:22,596 | 1640 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\History\History.IE5\desktop.ini DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,596 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,596 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000354 FileInformation => \xc0s\xe9\xbf\x8a\xa2\xcf\x01\xc0s\xe9\xbf\x8a\xa2\xcf\x01\xc0s\xe9\xbf\x8a\xa2\xcf\x01\xc0s\xe9\xbf\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x00C\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00XL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xb8\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:22,596 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,596 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,596 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,596 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x002433a0 | |
| 09:18:22,596 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\History |
SUCCESS | 0x002433a0 | |
| 09:18:22,606 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\History\History.IE5 |
SUCCESS | 0x002433a0 | |
| 09:18:22,606 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\History\History.IE5\desktop.ini |
SUCCESS | 0x002433a0 | |
| 09:18:22,606 | 1640 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\History\History.IE5\desktop.ini DesiredAccess => 0x00100100 CreateDisposition => 1 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,606 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,606 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000354 FileInformation => \x00\xe9\x90|`G9\x000O9\x00|\xd8\x90|\xea\x82 |
FAILURE | 3221225506 | |
| 09:18:22,606 | 1640 | NtOpenKey |
DesiredAccess => 15 KeyHandle => 0x00000364 ObjectAttributes => Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache |
SUCCESS | 0x00000000 | |
| 09:18:22,606 | 1640 | NtOpenKey |
DesiredAccess => 15 KeyHandle => 0x00000364 ObjectAttributes => Extensible Cache |
SUCCESS | 0x00000000 | |
| 09:18:22,606 | 1640 | NtOpenKey |
DesiredAccess => 15 KeyHandle => 0x00000364 ObjectAttributes => MSHist012014071820140719 |
SUCCESS | 0x00000000 | |
| 09:18:22,606 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,606 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,606 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x002433a0 | |
| 09:18:22,616 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x002433a0 | |
| 09:18:22,616 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x002433a0 | |
| 09:18:22,616 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\index.dat |
SUCCESS | 0x002433a0 | |
| 09:18:22,616 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\index.dat DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,616 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,616 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000354 FileInformation => \x90y\xcf\xbf\x8a\xa2\xcf\x01\x90y\xcf\xbf\x8a\xa2\xcf\x01\xf0\xfa\xea\xbf\x8a\xa2\xcf\x01\xf0\xfa\xea\xbf\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00IL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xd6\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:22,646 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,646 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002433a0 | |
| 09:18:22,646 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002433a0 | |
| 09:18:22,646 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002433a0 | |
| 09:18:22,646 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,646 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,646 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000354 FileInformation => \xa0\xb0\x1c\xbf\x8a\xa2\xcf\x01\xb0\x17\xf1\xbf\x8a\xa2\xcf\x01\xb0\x17\xf1\xbf\x8a\xa2\xcf\x01\xb0\x17\xf1\xbf\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00YL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:22,666 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,666 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002433a0 | |
| 09:18:22,666 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002433a0 | |
| 09:18:22,666 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002433a0 | |
| 09:18:22,666 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,666 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002433a0 | |
| 09:18:22,666 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002433a0 | |
| 09:18:22,666 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002433a0 | |
| 09:18:22,666 | 1640 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,666 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,666 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,666 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002433a0 | |
| 09:18:22,666 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002433a0 | |
| 09:18:22,676 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,676 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,676 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,676 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002433a0 | |
| 09:18:22,676 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002433a0 | |
| 09:18:22,676 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,676 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,676 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,676 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002433a0 | |
| 09:18:22,676 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002433a0 | |
| 09:18:22,676 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002433a0 | |
| 09:18:22,676 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,676 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,676 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,676 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002433a0 | |
| 09:18:22,676 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002433a0 | |
| 09:18:22,676 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002433a0 | |
| 09:18:22,676 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,686 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,686 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,686 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002433a0 | |
| 09:18:22,686 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002433a0 | |
| 09:18:22,686 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002433a0 | |
| 09:18:22,686 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,686 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002433a0 | |
| 09:18:22,686 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002433a0 | |
| 09:18:22,686 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002433a0 | |
| 09:18:22,686 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\assets DesiredAccess => 0x00100001 CreateDisposition => 2 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,686 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,686 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,686 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002433a0 | |
| 09:18:22,686 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002433a0 | |
| 09:18:22,686 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002433a0 | |
| 09:18:22,686 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,686 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,696 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000354 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\x10&\xf4\xbf\x8a\xa2\xcf\x01\x10&\xf4\xbf\x8a\xa2\xcf\x01\x10&\xf4\xbf\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:22,696 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,696 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002433a0 | |
| 09:18:22,696 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002433a0 | |
| 09:18:22,696 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002433a0 | |
| 09:18:22,696 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,696 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,696 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000354 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\x10&\xf4\xbf\x8a\xa2\xcf\x01\x10&\xf4\xbf\x8a\xa2\xcf\x01\x10&\xf4\xbf\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:22,696 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,706 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002433a0 | |
| 09:18:22,706 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002433a0 | |
| 09:18:22,706 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002433a0 | |
| 09:18:22,706 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,706 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,706 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000354 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\xa0\xbb\xf8\xbf\x8a\xa2\xcf\x01\x10&\xf4\xbf\x8a\xa2\xcf\x01\x10&\xf4\xbf\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:22,706 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,706 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002433a0 | |
| 09:18:22,706 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002433a0 | |
| 09:18:22,706 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002433a0 | |
| 09:18:22,706 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,706 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,706 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000354 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\xa0\xbb\xf8\xbf\x8a\xa2\xcf\x01\x10&\xf4\xbf\x8a\xa2\xcf\x01\x10&\xf4\xbf\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:22,726 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,726 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002433a0 | |
| 09:18:22,726 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002433a0 | |
| 09:18:22,726 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002433a0 | |
| 09:18:22,726 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,726 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,726 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000354 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\xd0B\xfa\xbf\x8a\xa2\xcf\x01\x10&\xf4\xbf\x8a\xa2\xcf\x01\x10&\xf4\xbf\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:22,726 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,726 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002433a0 | |
| 09:18:22,726 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002433a0 | |
| 09:18:22,726 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002433a0 | |
| 09:18:22,726 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,726 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,736 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000354 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\xd0B\xfa\xbf\x8a\xa2\xcf\x01\x10&\xf4\xbf\x8a\xa2\xcf\x01\x10&\xf4\xbf\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:22,736 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,736 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002433a0 | |
| 09:18:22,736 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002433a0 | |
| 09:18:22,736 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002433a0 | |
| 09:18:22,736 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,736 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,736 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000354 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01`\xd8\xfe\xbf\x8a\xa2\xcf\x01\x10&\xf4\xbf\x8a\xa2\xcf\x01\x10&\xf4\xbf\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:22,736 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,736 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002433a0 | |
| 09:18:22,736 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002433a0 | |
| 09:18:22,736 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002433a0 | |
| 09:18:22,736 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,736 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,746 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000354 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01`\xd8\xfe\xbf\x8a\xa2\xcf\x01\x10&\xf4\xbf\x8a\xa2\xcf\x01\x10&\xf4\xbf\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:22,746 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,746 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002433a0 | |
| 09:18:22,746 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002433a0 | |
| 09:18:22,746 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002433a0 | |
| 09:18:22,746 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,746 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,746 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000354 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\x90_\x00\xc0\x8a\xa2\xcf\x01\x10&\xf4\xbf\x8a\xa2\xcf\x01\x10&\xf4\xbf\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:22,746 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,746 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002433a0 | |
| 09:18:22,746 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002433a0 | |
| 09:18:22,756 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002433a0 | |
| 09:18:22,756 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,756 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,756 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000354 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\x90_\x00\xc0\x8a\xa2\xcf\x01\x10&\xf4\xbf\x8a\xa2\xcf\x01\x10&\xf4\xbf\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:22,756 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,756 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002433a0 | |
| 09:18:22,756 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002433a0 | |
| 09:18:22,756 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002433a0 | |
| 09:18:22,756 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,756 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,756 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000354 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\x90_\x00\xc0\x8a\xa2\xcf\x01\x10&\xf4\xbf\x8a\xa2\xcf\x01\x10&\xf4\xbf\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:22,756 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,756 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002433a0 | |
| 09:18:22,756 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002433a0 | |
| 09:18:22,766 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002433a0 | |
| 09:18:22,766 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,766 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,766 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000354 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\xc0\xe6\x01\xc0\x8a\xa2\xcf\x01\x10&\xf4\xbf\x8a\xa2\xcf\x01\x10&\xf4\xbf\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:22,776 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,776 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002433a0 | |
| 09:18:22,776 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002433a0 | |
| 09:18:22,776 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002433a0 | |
| 09:18:22,776 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,776 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,776 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000354 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\xf0m\x03\xc0\x8a\xa2\xcf\x01\x10&\xf4\xbf\x8a\xa2\xcf\x01\x10&\xf4\xbf\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:22,776 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,776 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002433a0 | |
| 09:18:22,776 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002433a0 | |
| 09:18:22,776 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002433a0 | |
| 09:18:22,776 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,776 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,776 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000354 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\xf0m\x03\xc0\x8a\xa2\xcf\x01\x10&\xf4\xbf\x8a\xa2\xcf\x01\x10&\xf4\xbf\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:22,786 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,786 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002433a0 | |
| 09:18:22,786 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002433a0 | |
| 09:18:22,786 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002433a0 | |
| 09:18:22,786 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,786 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,786 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000354 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01P|\x06\xc0\x8a\xa2\xcf\x01\x10&\xf4\xbf\x8a\xa2\xcf\x01\x10&\xf4\xbf\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:22,786 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,786 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002433a0 | |
| 09:18:22,786 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002433a0 | |
| 09:18:22,796 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002433a0 | |
| 09:18:22,796 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,796 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,796 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000354 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01P|\x06\xc0\x8a\xa2\xcf\x01\x10&\xf4\xbf\x8a\xa2\xcf\x01\x10&\xf4\xbf\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:22,796 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,796 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002433a0 | |
| 09:18:22,796 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002433a0 | |
| 09:18:22,796 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002433a0 | |
| 09:18:22,796 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,796 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,796 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000354 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01P|\x06\xc0\x8a\xa2\xcf\x01\x10&\xf4\xbf\x8a\xa2\xcf\x01\x10&\xf4\xbf\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:22,796 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,796 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002433a0 | |
| 09:18:22,796 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002433a0 | |
| 09:18:22,796 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002433a0 | |
| 09:18:22,796 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,796 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,796 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000354 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\x80\x03\x08\xc0\x8a\xa2\xcf\x01\x10&\xf4\xbf\x8a\xa2\xcf\x01\x10&\xf4\xbf\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:22,817 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,817 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002433a0 | |
| 09:18:22,817 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002433a0 | |
| 09:18:22,817 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002433a0 | |
| 09:18:22,817 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,817 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,817 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000354 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\x80\x03\x08\xc0\x8a\xa2\xcf\x01\x10&\xf4\xbf\x8a\xa2\xcf\x01\x10&\xf4\xbf\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:22,817 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,817 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002433a0 | |
| 09:18:22,827 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002433a0 | |
| 09:18:22,827 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002433a0 | |
| 09:18:22,827 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,827 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,827 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000354 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\x80\x03\x08\xc0\x8a\xa2\xcf\x01\x10&\xf4\xbf\x8a\xa2\xcf\x01\x10&\xf4\xbf\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:22,827 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,827 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002433a0 | |
| 09:18:22,827 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002433a0 | |
| 09:18:22,827 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002433a0 | |
| 09:18:22,827 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,827 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,827 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000354 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\x10\x99\x0c\xc0\x8a\xa2\xcf\x01\x10&\xf4\xbf\x8a\xa2\xcf\x01\x10&\xf4\xbf\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:22,837 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,837 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002433a0 | |
| 09:18:22,837 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002433a0 | |
| 09:18:22,837 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002433a0 | |
| 09:18:22,837 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,837 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,837 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000354 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\x10\x99\x0c\xc0\x8a\xa2\xcf\x01\x10&\xf4\xbf\x8a\xa2\xcf\x01\x10&\xf4\xbf\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:22,837 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,837 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002433a0 | |
| 09:18:22,837 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002433a0 | |
| 09:18:22,837 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002433a0 | |
| 09:18:22,837 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,837 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,837 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000354 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\x10\x99\x0c\xc0\x8a\xa2\xcf\x01\x10&\xf4\xbf\x8a\xa2\xcf\x01\x10&\xf4\xbf\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:22,837 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,837 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002433a0 | |
| 09:18:22,847 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002433a0 | |
| 09:18:22,847 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002433a0 | |
| 09:18:22,847 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,847 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,847 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000354 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01@ \x0e\xc0\x8a\xa2\xcf\x01\x10&\xf4\xbf\x8a\xa2\xcf\x01\x10&\xf4\xbf\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:22,857 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,857 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002433a0 | |
| 09:18:22,857 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002433a0 | |
| 09:18:22,857 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002433a0 | |
| 09:18:22,857 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,857 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,857 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000354 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01p\xa7\x0f\xc0\x8a\xa2\xcf\x01\x10&\xf4\xbf\x8a\xa2\xcf\x01\x10&\xf4\xbf\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:22,857 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,857 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002433a0 | |
| 09:18:22,857 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002433a0 | |
| 09:18:22,857 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002433a0 | |
| 09:18:22,857 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,857 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,857 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000354 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01p\xa7\x0f\xc0\x8a\xa2\xcf\x01\x10&\xf4\xbf\x8a\xa2\xcf\x01\x10&\xf4\xbf\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:22,867 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,867 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002433a0 | |
| 09:18:22,867 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002433a0 | |
| 09:18:22,867 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002433a0 | |
| 09:18:22,867 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,867 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,867 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000354 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\xa0.\x11\xc0\x8a\xa2\xcf\x01\x10&\xf4\xbf\x8a\xa2\xcf\x01\x10&\xf4\xbf\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:22,867 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,867 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002433a0 | |
| 09:18:22,867 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002433a0 | |
| 09:18:22,867 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002433a0 | |
| 09:18:22,867 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,867 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,867 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000354 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\xd0\xb5\x12\xc0\x8a\xa2\xcf\x01\x10&\xf4\xbf\x8a\xa2\xcf\x01\x10&\xf4\xbf\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:22,877 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,877 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002433a0 | |
| 09:18:22,877 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002433a0 | |
| 09:18:22,877 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002433a0 | |
| 09:18:22,877 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,877 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,877 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000354 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\xd0\xb5\x12\xc0\x8a\xa2\xcf\x01\x10&\xf4\xbf\x8a\xa2\xcf\x01\x10&\xf4\xbf\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:22,877 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,877 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002433a0 | |
| 09:18:22,877 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002433a0 | |
| 09:18:22,877 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002433a0 | |
| 09:18:22,877 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,877 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,877 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000354 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\x00=\x14\xc0\x8a\xa2\xcf\x01\x10&\xf4\xbf\x8a\xa2\xcf\x01\x10&\xf4\xbf\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:22,897 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,897 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002433a0 | |
| 09:18:22,897 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002433a0 | |
| 09:18:22,897 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002433a0 | |
| 09:18:22,897 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,897 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,897 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000354 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\x00=\x14\xc0\x8a\xa2\xcf\x01\x10&\xf4\xbf\x8a\xa2\xcf\x01\x10&\xf4\xbf\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:22,897 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,897 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002433a0 | |
| 09:18:22,897 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002433a0 | |
| 09:18:22,897 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002433a0 | |
| 09:18:22,897 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,897 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,897 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000354 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\x00=\x14\xc0\x8a\xa2\xcf\x01\x10&\xf4\xbf\x8a\xa2\xcf\x01\x10&\xf4\xbf\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:22,897 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,897 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002433a0 | |
| 09:18:22,907 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002433a0 | |
| 09:18:22,907 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002433a0 | |
| 09:18:22,907 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,907 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,907 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000354 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01`K\x17\xc0\x8a\xa2\xcf\x01\x10&\xf4\xbf\x8a\xa2\xcf\x01\x10&\xf4\xbf\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:22,907 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,907 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002433a0 | |
| 09:18:22,907 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002433a0 | |
| 09:18:22,907 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002433a0 | |
| 09:18:22,907 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,907 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,907 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000354 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\x90\xd2\x18\xc0\x8a\xa2\xcf\x01\x10&\xf4\xbf\x8a\xa2\xcf\x01\x10&\xf4\xbf\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:22,907 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,907 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002433a0 | |
| 09:18:22,907 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002433a0 | |
| 09:18:22,917 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002433a0 | |
| 09:18:22,917 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,917 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,917 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000354 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\x90\xd2\x18\xc0\x8a\xa2\xcf\x01\x10&\xf4\xbf\x8a\xa2\xcf\x01\x10&\xf4\xbf\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:22,917 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,917 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002433a0 | |
| 09:18:22,917 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002433a0 | |
| 09:18:22,917 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002433a0 | |
| 09:18:22,917 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,917 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,917 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000354 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\xc0Y\x1a\xc0\x8a\xa2\xcf\x01\x10&\xf4\xbf\x8a\xa2\xcf\x01\x10&\xf4\xbf\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:22,917 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,917 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002433a0 | |
| 09:18:22,927 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002433a0 | |
| 09:18:22,927 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002433a0 | |
| 09:18:22,927 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,927 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,927 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000354 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\xc0Y\x1a\xc0\x8a\xa2\xcf\x01\x10&\xf4\xbf\x8a\xa2\xcf\x01\x10&\xf4\xbf\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:22,927 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,927 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002433a0 | |
| 09:18:22,927 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002433a0 | |
| 09:18:22,927 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002433a0 | |
| 09:18:22,927 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,927 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,927 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000354 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\xc0Y\x1a\xc0\x8a\xa2\xcf\x01\x10&\xf4\xbf\x8a\xa2\xcf\x01\x10&\xf4\xbf\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:22,927 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,927 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002433a0 | |
| 09:18:22,927 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002433a0 | |
| 09:18:22,927 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002433a0 | |
| 09:18:22,927 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,937 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,937 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000354 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\xf0\xe0\x1b\xc0\x8a\xa2\xcf\x01\x10&\xf4\xbf\x8a\xa2\xcf\x01\x10&\xf4\xbf\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:22,947 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,947 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002433a0 | |
| 09:18:22,947 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002433a0 | |
| 09:18:22,947 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002433a0 | |
| 09:18:22,947 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,947 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,947 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000354 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01 h\x1d\xc0\x8a\xa2\xcf\x01\x10&\xf4\xbf\x8a\xa2\xcf\x01\x10&\xf4\xbf\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:22,947 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,947 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002433a0 | |
| 09:18:22,947 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002433a0 | |
| 09:18:22,947 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002433a0 | |
| 09:18:22,947 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,947 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,947 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000354 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01 h\x1d\xc0\x8a\xa2\xcf\x01\x10&\xf4\xbf\x8a\xa2\xcf\x01\x10&\xf4\xbf\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:22,957 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,957 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002433a0 | |
| 09:18:22,957 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002433a0 | |
| 09:18:22,957 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002433a0 | |
| 09:18:22,957 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,957 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,957 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000354 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01P\xef\x1e\xc0\x8a\xa2\xcf\x01\x10&\xf4\xbf\x8a\xa2\xcf\x01\x10&\xf4\xbf\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:22,957 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,957 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002433a0 | |
| 09:18:22,957 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002433a0 | |
| 09:18:22,957 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002433a0 | |
| 09:18:22,957 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,957 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,957 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000354 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01P\xef\x1e\xc0\x8a\xa2\xcf\x01\x10&\xf4\xbf\x8a\xa2\xcf\x01\x10&\xf4\xbf\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:22,957 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,967 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002433a0 | |
| 09:18:22,967 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002433a0 | |
| 09:18:22,967 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002433a0 | |
| 09:18:22,967 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,967 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,967 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000354 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\x80v \xc0\x8a\xa2\xcf\x01\x10&\xf4\xbf\x8a\xa2\xcf\x01\x10&\xf4\xbf\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:22,967 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,967 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002433a0 | |
| 09:18:22,967 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002433a0 | |
| 09:18:22,967 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002433a0 | |
| 09:18:22,967 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,967 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,967 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000354 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\x80v \xc0\x8a\xa2\xcf\x01\x10&\xf4\xbf\x8a\xa2\xcf\x01\x10&\xf4\xbf\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:22,987 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,987 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002433a0 | |
| 09:18:22,987 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002433a0 | |
| 09:18:22,987 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002433a0 | |
| 09:18:22,987 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,987 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,987 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000354 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\xb0\xfd!\xc0\x8a\xa2\xcf\x01\x10&\xf4\xbf\x8a\xa2\xcf\x01\x10&\xf4\xbf\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:22,987 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:22,987 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002433a0 | |
| 09:18:22,987 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002433a0 | |
| 09:18:22,987 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002433a0 | |
| 09:18:22,987 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:22,987 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:22,987 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000354 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\xb0\xfd!\xc0\x8a\xa2\xcf\x01\x10&\xf4\xbf\x8a\xa2\xcf\x01\x10&\xf4\xbf\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:23,107 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:23,107 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002433a0 | |
| 09:18:23,107 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002433a0 | |
| 09:18:23,117 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002433a0 | |
| 09:18:23,117 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:23,117 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:23,117 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000354 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\x10\x0c%\xc0\x8a\xa2\xcf\x01\x10&\xf4\xbf\x8a\xa2\xcf\x01\x10&\xf4\xbf\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:23,117 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:23,117 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002433a0 | |
| 09:18:23,117 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002433a0 | |
| 09:18:23,117 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002433a0 | |
| 09:18:23,117 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:23,117 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:23,117 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000354 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\x80\xe98\xc0\x8a\xa2\xcf\x01\x10&\xf4\xbf\x8a\xa2\xcf\x01\x10&\xf4\xbf\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:23,117 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:23,117 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002433a0 | |
| 09:18:23,117 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002433a0 | |
| 09:18:23,117 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002433a0 | |
| 09:18:23,127 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:23,127 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:23,127 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000354 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\x80\xe98\xc0\x8a\xa2\xcf\x01\x10&\xf4\xbf\x8a\xa2\xcf\x01\x10&\xf4\xbf\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:23,127 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:23,127 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002433a0 | |
| 09:18:23,127 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002433a0 | |
| 09:18:23,127 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002433a0 | |
| 09:18:23,137 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:23,137 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:23,137 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000354 FileInformation => \xa0\xb0\x1c\xbf\x8a\xa2\xcf\x01\xb0p:\xc0\x8a\xa2\xcf\x01\xb0p:\xc0\x8a\xa2\xcf\x01\xb0p:\xc0\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00ZL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:23,137 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:23,137 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002433a0 | |
| 09:18:23,137 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002433a0 | |
| 09:18:23,137 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002433a0 | |
| 09:18:23,137 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:23,137 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002433a0 | |
| 09:18:23,137 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002433a0 | |
| 09:18:23,137 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002433a0 | |
| 09:18:23,137 | 1640 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:23,147 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:23,147 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:23,147 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002433a0 | |
| 09:18:23,147 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002433a0 | |
| 09:18:23,147 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002433a0 | |
| 09:18:23,147 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:23,147 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:23,147 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000354 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\xe0\xf7;\xc0\x8a\xa2\xcf\x01\xe0\xf7;\xc0\x8a\xa2\xcf\x01\xe0\xf7;\xc0\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:23,147 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:23,147 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002433a0 | |
| 09:18:23,147 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002433a0 | |
| 09:18:23,147 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002433a0 | |
| 09:18:23,147 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:23,147 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:23,157 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000354 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\x10\x7f=\xc0\x8a\xa2\xcf\x01\xe0\xf7;\xc0\x8a\xa2\xcf\x01\xe0\xf7;\xc0\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:23,157 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:23,157 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002433a0 | |
| 09:18:23,157 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002433a0 | |
| 09:18:23,157 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002433a0 | |
| 09:18:23,157 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:23,157 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:23,157 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000354 FileInformation => \xa0\xb0\x1c\xbf\x8a\xa2\xcf\x01@\x06?\xc0\x8a\xa2\xcf\x01@\x06?\xc0\x8a\xa2\xcf\x01@\x06?\xc0\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00ZL\x00\x00\x00\x00\x02\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:23,157 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:23,157 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002433a0 | |
| 09:18:23,157 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002433a0 | |
| 09:18:23,167 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002433a0 | |
| 09:18:23,167 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:23,167 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002433a0 | |
| 09:18:23,167 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002433a0 | |
| 09:18:23,167 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002433a0 | |
| 09:18:23,167 | 1640 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:23,167 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:23,257 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:23,257 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002433a0 | |
| 09:18:23,257 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002433a0 | |
| 09:18:23,257 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002433a0 | |
| 09:18:23,257 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:23,257 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:23,257 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000354 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01@\x06?\xc0\x8a\xa2\xcf\x01@\x06?\xc0\x8a\xa2\xcf\x01@\x06?\xc0\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:23,257 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:23,257 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002433a0 | |
| 09:18:23,257 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002433a0 | |
| 09:18:23,257 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002433a0 | |
| 09:18:23,257 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:23,257 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:23,267 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000354 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01 NN\xc0\x8a\xa2\xcf\x01@\x06?\xc0\x8a\xa2\xcf\x01@\x06?\xc0\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:23,267 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:23,267 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002433a0 | |
| 09:18:23,267 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002433a0 | |
| 09:18:23,267 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002433a0 | |
| 09:18:23,267 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:23,267 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:23,267 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000354 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01P\xd5O\xc0\x8a\xa2\xcf\x01@\x06?\xc0\x8a\xa2\xcf\x01@\x06?\xc0\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:23,267 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002433a0 | |
| 09:18:23,267 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002433a0 | |
| 09:18:23,267 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002433a0 | |
| 09:18:23,267 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002433a0 | |
| 09:18:23,267 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:18:23,267 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000364 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:23,267 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000354 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01P\xd5O\xc0\x8a\xa2\xcf\x01@\x06?\xc0\x8a\xa2\xcf\x01@\x06?\xc0\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:23,287 | 1640 | LdrLoadDll |
Flags => 33291276 BaseAddress => 0x771b0000 FileName => WININET.dll |
SUCCESS | 0x00000000 | |
| 09:18:23,287 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => InternetOpenA FunctionAddress => 0x771c578e ModuleHandle => 0x771b0000 |
SUCCESS | 0x00000000 | |
| 09:18:23,287 | 1640 | RegQueryValueExA |
Handle => 0x00000354 DataLength => 4 ValueName => FromCacheTimeout Type => 852 |
FAILURE | 0x00000002 | |
| 09:18:23,287 | 1640 | RegQueryValueExA |
Handle => 0x00000354 DataLength => 4 ValueName => SecureProtocols Type => 852 |
FAILURE | 0x00000002 | |
| 09:18:23,287 | 1640 | RegQueryValueExA |
Handle => 0x00000354 DataLength => 4 ValueName => CertificateRevocation Type => 852 |
FAILURE | 0x00000002 | |
| 09:18:23,287 | 1640 | RegQueryValueExA |
Handle => 0x00000354 DataLength => 4 ValueName => DisableKeepAlive Type => 852 |
FAILURE | 0x00000002 | |
| 09:18:23,287 | 1640 | RegQueryValueExA |
Handle => 0x00000354 DataLength => 4 ValueName => DisablePassport Type => 852 |
FAILURE | 0x00000002 | |
| 09:18:23,287 | 1640 | RegQueryValueExA |
Handle => 0x00000354 DataLength => 4 ValueName => CacheMode Type => 852 |
FAILURE | 0x00000002 | |
| 09:18:23,287 | 1640 | RegOpenKeyExA |
Handle => 0x00000370 Registry => 0x80000002 SubKey => SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:18:23,287 | 1640 | RegQueryValueExA |
Handle => 0x00000370 DataLength => 4 ValueName => Security_HKLM_only Type => 880 |
FAILURE | 0x00000002 | |
| 09:18:23,287 | 1640 | RegCloseKey |
Handle => 0x00000370 |
SUCCESS | 0x00000000 | |
| 09:18:23,287 | 1640 | RegOpenKeyExA |
Handle => 0x00000370 Registry => 0x80000002 SubKey => SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:18:23,287 | 1640 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000001 SubKey => SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings |
FAILURE | 0x00000002 | |
| 09:18:23,287 | 1640 | RegOpenKeyExA |
Handle => 0x00000374 Registry => 0x80000002 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:18:23,287 | 1640 | RegOpenKeyExA |
Handle => 0x00000378 Registry => 0x80000001 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:18:23,287 | 1640 | RegQueryValueExA |
Handle => 0x00000370 DataLength => 4 ValueName => EnableHttp1_1 Type => 880 |
FAILURE | 0x00000002 | |
| 09:18:23,287 | 1640 | RegQueryValueExA |
Handle => 0x00000378 Data => 1 ValueName => EnableHttp1_1 |
SUCCESS | 0x00000000 | |
| 09:18:23,297 | 1640 | RegCloseKey |
Handle => 0x00000370 |
SUCCESS | 0x00000000 | |
| 09:18:23,297 | 1640 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | |
| 09:18:23,297 | 1640 | RegCloseKey |
Handle => 0x00000374 |
SUCCESS | 0x00000000 | |
| 09:18:23,297 | 1640 | RegCloseKey |
Handle => 0x00000378 |
SUCCESS | 0x00000000 | |
| 09:18:23,297 | 1640 | RegOpenKeyExA |
Handle => 0x00000378 Registry => 0x80000002 SubKey => SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:18:23,297 | 1640 | RegQueryValueExA |
Handle => 0x00000378 DataLength => 4 ValueName => Security_HKLM_only Type => 888 |
FAILURE | 0x00000002 | |
| 09:18:23,297 | 1640 | RegCloseKey |
Handle => 0x00000378 |
SUCCESS | 0x00000000 | |
| 09:18:23,297 | 1640 | RegOpenKeyExA |
Handle => 0x00000378 Registry => 0x80000002 SubKey => SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:18:23,297 | 1640 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000001 SubKey => SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings |
FAILURE | 0x00000002 | |
| 09:18:23,297 | 1640 | RegOpenKeyExA |
Handle => 0x00000374 Registry => 0x80000002 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:18:23,297 | 1640 | RegOpenKeyExA |
Handle => 0x00000370 Registry => 0x80000001 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:18:23,297 | 1640 | RegQueryValueExA |
Handle => 0x00000378 DataLength => 4 ValueName => ProxyHttp1.1 Type => 888 |
FAILURE | 0x00000002 | |
| 09:18:23,297 | 1640 | RegQueryValueExA |
Handle => 0x00000370 DataLength => 4 ValueName => ProxyHttp1.1 Type => 880 |
FAILURE | 0x00000002 | |
| 09:18:23,297 | 1640 | RegQueryValueExA |
Handle => 0x00000374 DataLength => 4 ValueName => ProxyHttp1.1 Type => 884 |
FAILURE | 0x00000002 | |
| 09:18:23,297 | 1640 | RegCloseKey |
Handle => 0x00000378 |
SUCCESS | 0x00000000 | |
| 09:18:23,297 | 1640 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | |
| 09:18:23,297 | 1640 | RegCloseKey |
Handle => 0x00000374 |
SUCCESS | 0x00000000 | |
| 09:18:23,297 | 1640 | RegCloseKey |
Handle => 0x00000370 |
SUCCESS | 0x00000000 | |
| 09:18:23,297 | 1640 | RegQueryValueExA |
Handle => 0x00000354 Data => 1 ValueName => EnableNegotiate |
SUCCESS | 0x00000000 | |
| 09:18:23,297 | 1640 | RegQueryValueExA |
Handle => 0x00000354 DataLength => 4 ValueName => DisableBasicOverClearChannel Type => 852 |
FAILURE | 0x00000002 | |
| 09:18:23,297 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:18:23,297 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:18:23,297 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:18:23,297 | 1640 | RegOpenKeyExW |
Handle => 0x00000370 Registry => 0x80000002 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
SUCCESS | 0x00000000 | |
| 09:18:23,307 | 1640 | RegQueryValueExA |
Handle => 0x00000370 DataLength => 4 ValueName => Feature_ClientAuthCertFilter Type => 880 |
FAILURE | 0x00000002 | |
| 09:18:23,307 | 1640 | RegCloseKey |
Handle => 0x00000370 |
SUCCESS | 0x00000000 | |
| 09:18:23,307 | 1640 | RegQueryValueExA |
Handle => 0x00000354 DataLength => 4 ValueName => SyncMode5 Type => 852 |
FAILURE | 0x00000002 | |
| 09:18:23,307 | 1640 | RegOpenKeyExA |
Handle => 0x00000370 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Cache |
SUCCESS | 0x00000000 | |
| 09:18:23,307 | 1640 | RegQueryValueExA |
Handle => 0x00000370 DataLength => 4 ValueName => FixupKey Type => 880 |
FAILURE | 0x00000002 | |
| 09:18:23,307 | 1640 | RegCloseKey |
Handle => 0x00000370 |
SUCCESS | 0x00000000 | |
| 09:18:23,307 | 1640 | RegOpenKeyExA |
Handle => 0x00000370 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache |
SUCCESS | 0x00000000 | |
| 09:18:23,307 | 1640 | RegQueryValueExA |
Handle => 0x00000370 DataLength => 4 ValueName => SessionStartTimeDefaultDeltaSecs Type => 880 |
FAILURE | 0x00000002 | |
| 09:18:23,307 | 1640 | RegCloseKey |
Handle => 0x00000370 |
SUCCESS | 0x00000000 | |
| 09:18:23,307 | 1640 | RegOpenKeyExA |
Handle => 0x00000370 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache |
SUCCESS | 0x00000000 | |
| 09:18:23,307 | 1640 | RegOpenKeyExA |
Handle => 0x00000374 Registry => 0x80000002 SubKey => System\Setup |
SUCCESS | 0x00000000 | |
| 09:18:23,307 | 1640 | RegQueryValueExA |
Handle => 0x00000374 Data => 0 ValueName => SystemSetupInProgress |
SUCCESS | 0x00000000 | |
| 09:18:23,307 | 1640 | RegCloseKey |
Handle => 0x00000374 |
SUCCESS | 0x00000000 | |
| 09:18:23,307 | 1640 | RegOpenKeyExA |
Handle => 0x00000374 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders |
SUCCESS | 0x00000000 | |
| 09:18:23,307 | 1640 | RegOpenKeyExA |
Handle => 0x00000378 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache |
SUCCESS | 0x00000000 | |
| 09:18:23,307 | 1640 | RegOpenKeyExA |
Handle => 0x0000037c Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders |
SUCCESS | 0x00000000 | |
| 09:18:23,307 | 1640 | RegOpenKeyExA |
Handle => 0x00000380 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache |
SUCCESS | 0x00000000 | |
| 09:18:23,307 | 1640 | RegQueryValueExA |
Handle => 0x00000380 Data => Client UrlCache MMF Ver 5.2\x00 ValueName => Signature |
SUCCESS | 0x00000000 | |
| 09:18:23,307 | 1640 | RegCloseKey |
Handle => 0x00000380 |
SUCCESS | 0x00000000 | |
| 09:18:23,307 | 1640 | RegOpenKeyExA |
Handle => 0x00000380 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders |
SUCCESS | 0x00000000 | |
| 09:18:23,307 | 1640 | RegQueryValueExA |
Handle => 0x00000380 DataLength => 54 ValueName => Cache Type => 2 |
SUCCESS | 0x00000000 | |
| 09:18:23,307 | 1640 | RegQueryValueExA |
Handle => 0x00000380 DataLength => 22 ValueName => Cookies Type => 2 |
SUCCESS | 0x00000000 | |
| 09:18:23,307 | 1640 | RegQueryValueExA |
Handle => 0x00000380 DataLength => 37 ValueName => History Type => 2 |
SUCCESS | 0x00000000 | |
| 09:18:23,307 | 1640 | RegCloseKey |
Handle => 0x00000380 |
SUCCESS | 0x00000000 | |
| 09:18:23,307 | 1640 | RegOpenKeyExA |
Handle => 0x00000380 Registry => 0x00000378 SubKey => Content |
SUCCESS | 0x00000000 | |
| 09:18:23,307 | 1640 | RegQueryValueExA |
Handle => 0x00000380 DataLength => 4 ValueName => PerUserItem Type => 896 |
FAILURE | 0x00000002 | |
| 09:18:23,307 | 1640 | RegOpenKeyExA |
Handle => 0x00000384 Registry => 0x00000370 SubKey => Content |
SUCCESS | 0x00000000 | |
| 09:18:23,307 | 1640 | RegQueryValueExA |
Handle => 0x00000384 Data => 1 ValueName => PerUserItem |
SUCCESS | 0x00000000 | |
| 09:18:23,307 | 1640 | RegCloseKey |
Handle => 0x00000384 |
SUCCESS | 0x00000000 | |
| 09:18:23,307 | 1640 | RegCloseKey |
Handle => 0x00000380 |
SUCCESS | 0x00000000 | |
| 09:18:23,307 | 1640 | RegOpenKeyExA |
Handle => 0x00000380 Registry => 0x00000378 SubKey => Content |
SUCCESS | 0x00000000 | |
| 09:18:23,307 | 1640 | LdrLoadDll |
Flags => 33288952 BaseAddress => 0x7c9c0000 FileName => shell32.dll |
SUCCESS | 0x00000000 | |
| 09:18:23,307 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => SHGetFolderPathA FunctionAddress => 0x7ca2ac11 ModuleHandle => 0x7c9c0000 |
SUCCESS | 0x00000000 | |
| 09:18:23,307 | 1640 | NtOpenFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temporary Internet Files DesiredAccess => 0x00100100 FileHandle => 0x00000384 |
SUCCESS | 0x00000000 | |
| 09:18:23,307 | 1640 | NtSetInformationFile |
FileHandle => 0x00000384 FileInformation => |
SUCCESS | 0x00000000 | |
| 09:18:23,307 | 1640 | RegQueryValueExA |
Handle => 0x00000380 Data => \x00 ValueName => CachePrefix |
SUCCESS | 0x00000000 | |
| 09:18:23,307 | 1640 | RegQueryValueExA |
Handle => 0x00000380 Data => 327323 ValueName => CacheLimit |
SUCCESS | 0x00000000 | |
| 09:18:23,307 | 1640 | RegOpenKeyExA |
Handle => 0x00000384 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Cache |
SUCCESS | 0x00000000 | |
| 09:18:23,307 | 1640 | RegOpenKeyExA |
Handle => 0x00000388 Registry => 0x00000384 SubKey => Paths |
SUCCESS | 0x00000000 | |
| 09:18:23,307 | 1640 | RegOpenKeyExA |
Handle => 0x0000038c Registry => 0x00000388 SubKey => Path1 |
SUCCESS | 0x00000000 | |
| 09:18:23,307 | 1640 | RegOpenKeyExA |
Handle => 0x00000390 Registry => 0x00000388 SubKey => Path2 |
SUCCESS | 0x00000000 | |
| 09:18:23,307 | 1640 | RegOpenKeyExA |
Handle => 0x00000394 Registry => 0x00000388 SubKey => Path3 |
SUCCESS | 0x00000000 | |
| 09:18:23,307 | 1640 | RegOpenKeyExA |
Handle => 0x00000398 Registry => 0x00000388 SubKey => Path4 |
SUCCESS | 0x00000000 | |
| 09:18:23,307 | 1640 | RegOpenKeyExA |
Handle => 0x0000039c Registry => 0x00000384 SubKey => Special Paths |
SUCCESS | 0x00000000 | |
| 09:18:23,307 | 1640 | RegSetValueExA |
Handle => 0x00000388 Buffer => C:\Documents and Settings\TDW\Local Settings\Temporary Internet Files\Content.IE5\x00 ValueName => Directory Type => 1 |
SUCCESS | 0x00000000 | |
| 09:18:23,307 | 1640 | RegSetValueExA |
Handle => 0x00000388 Buffer => 4 ValueName => Paths Type => 4 |
SUCCESS | 0x00000000 | |
| 09:18:23,307 | 1640 | RegSetValueExA |
Handle => 0x0000038c Buffer => C:\Documents and Settings\TDW\Local Settings\Temporary Internet Files\Content.IE5\Cache1\x00 ValueName => CachePath Type => 1 |
SUCCESS | 0x00000000 | |
| 09:18:23,317 | 1640 | RegSetValueExA |
Handle => 0x00000390 Buffer => C:\Documents and Settings\TDW\Local Settings\Temporary Internet Files\Content.IE5\Cache2\x00 ValueName => CachePath Type => 1 |
SUCCESS | 0x00000000 | |
| 09:18:23,317 | 1640 | RegSetValueExA |
Handle => 0x00000394 Buffer => C:\Documents and Settings\TDW\Local Settings\Temporary Internet Files\Content.IE5\Cache3\x00 ValueName => CachePath Type => 1 |
SUCCESS | 0x00000000 | |
| 09:18:23,317 | 1640 | RegSetValueExA |
Handle => 0x00000398 Buffer => C:\Documents and Settings\TDW\Local Settings\Temporary Internet Files\Content.IE5\Cache4\x00 ValueName => CachePath Type => 1 |
SUCCESS | 0x00000000 | |
| 09:18:23,317 | 1640 | RegSetValueExA |
Handle => 0x0000038c Buffer => 81830 ValueName => CacheLimit Type => 4 |
SUCCESS | 0x00000000 | |
| 09:18:23,317 | 1640 | RegSetValueExA |
Handle => 0x00000390 Buffer => 81830 ValueName => CacheLimit Type => 4 |
SUCCESS | 0x00000000 | |
| 09:18:23,317 | 1640 | RegSetValueExA |
Handle => 0x00000394 Buffer => 81830 ValueName => CacheLimit Type => 4 |
SUCCESS | 0x00000000 | |
| 09:18:23,317 | 1640 | RegSetValueExA |
Handle => 0x00000398 Buffer => 81830 ValueName => CacheLimit Type => 4 |
SUCCESS | 0x00000000 | |
| 09:18:23,317 | 1640 | RegCloseKey |
Handle => 0x00000398 |
SUCCESS | 0x00000000 | |
| 09:18:23,317 | 1640 | RegCloseKey |
Handle => 0x00000394 |
SUCCESS | 0x00000000 | |
| 09:18:23,317 | 1640 | RegCloseKey |
Handle => 0x00000390 |
SUCCESS | 0x00000000 | |
| 09:18:23,317 | 1640 | RegCloseKey |
Handle => 0x0000038c |
SUCCESS | 0x00000000 | |
| 09:18:23,317 | 1640 | RegCloseKey |
Handle => 0x00000388 |
SUCCESS | 0x00000000 | |
| 09:18:23,317 | 1640 | RegCloseKey |
Handle => 0x0000039c |
SUCCESS | 0x00000000 | |
| 09:18:23,317 | 1640 | RegCloseKey |
Handle => 0x00000384 |
SUCCESS | 0x00000000 | |
| 09:18:23,317 | 1640 | RegOpenKeyExA |
Handle => 0x00000384 Registry => 0x00000378 SubKey => Cookies |
SUCCESS | 0x00000000 | |
| 09:18:23,317 | 1640 | RegQueryValueExA |
Handle => 0x00000384 DataLength => 4 ValueName => PerUserItem Type => 900 |
FAILURE | 0x00000002 | |
| 09:18:23,317 | 1640 | RegOpenKeyExA |
Handle => 0x0000039c Registry => 0x00000370 SubKey => Cookies |
SUCCESS | 0x00000000 | |
| 09:18:23,317 | 1640 | RegQueryValueExA |
Handle => 0x0000039c Data => 1 ValueName => PerUserItem |
SUCCESS | 0x00000000 | |
| 09:18:23,317 | 1640 | RegCloseKey |
Handle => 0x0000039c |
SUCCESS | 0x00000000 | |
| 09:18:23,317 | 1640 | RegCloseKey |
Handle => 0x00000384 |
SUCCESS | 0x00000000 | |
| 09:18:23,317 | 1640 | RegCloseKey |
Handle => 0x00000380 |
SUCCESS | 0x00000000 | |
| 09:18:23,317 | 1640 | RegOpenKeyExA |
Handle => 0x00000380 Registry => 0x00000378 SubKey => Cookies |
SUCCESS | 0x00000000 | |
| 09:18:23,317 | 1640 | RegQueryValueExA |
Handle => 0x00000380 Data => Cookie:\x00 ValueName => CachePrefix |
SUCCESS | 0x00000000 | |
| 09:18:23,317 | 1640 | RegQueryValueExA |
Handle => 0x00000380 Data => 8192 ValueName => CacheLimit |
SUCCESS | 0x00000000 | |
| 09:18:23,317 | 1640 | RegOpenKeyExA |
Handle => 0x00000384 Registry => 0x00000378 SubKey => History |
SUCCESS | 0x00000000 | |
| 09:18:23,317 | 1640 | RegQueryValueExA |
Handle => 0x00000384 DataLength => 4 ValueName => PerUserItem Type => 900 |
FAILURE | 0x00000002 | |
| 09:18:23,317 | 1640 | RegOpenKeyExA |
Handle => 0x0000039c Registry => 0x00000370 SubKey => History |
SUCCESS | 0x00000000 | |
| 09:18:23,317 | 1640 | RegQueryValueExA |
Handle => 0x0000039c Data => 1 ValueName => PerUserItem |
SUCCESS | 0x00000000 | |
| 09:18:23,317 | 1640 | RegCloseKey |
Handle => 0x0000039c |
SUCCESS | 0x00000000 | |
| 09:18:23,317 | 1640 | RegCloseKey |
Handle => 0x00000384 |
SUCCESS | 0x00000000 | |
| 09:18:23,317 | 1640 | RegCloseKey |
Handle => 0x00000380 |
SUCCESS | 0x00000000 | |
| 09:18:23,317 | 1640 | RegOpenKeyExA |
Handle => 0x00000380 Registry => 0x00000378 SubKey => History |
SUCCESS | 0x00000000 | |
| 09:18:23,317 | 1640 | RegCreateKeyExW |
Handle => 0x00000384 Access => 33554432 Registry => 0x80000001 Class => SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders |
SUCCESS | 0x00000000 | |
| 09:18:23,317 | 1640 | RegQueryValueExW |
Handle => 0x00000384 Data => %\x00U\x00S\x00E\x00R\x00P\x00R\x00O\x00F\x00I\x00L\x00E\x00%\x00\\x00L\x00o\x00c\x00a\x00l\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00H\x00i\x00s\x00t\x00o\x00r\x00y\x00\x00\x00 ValueName => History |
SUCCESS | 0x00000000 | |
| 09:18:23,317 | 1640 | RegCloseKey |
Handle => 0x00000384 |
SUCCESS | 0x00000000 | |
| 09:18:23,317 | 1640 | RegCreateKeyExW |
Handle => 0x00000384 Access => 33554432 Registry => 0x80000001 Class => SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders |
SUCCESS | 0x00000000 | |
| 09:18:23,317 | 1640 | RegSetValueExW |
Handle => 0x00000384 Buffer => C\x00:\x00\\x00D\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00s\x00 \x00a\x00n\x00d\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00D\x00W\x00\\x00L\x00o\x00c\x00a\x00l\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00H\x00i\x00s\x00t\x00o\x00r\x00y\x00\x00\x00 ValueName => History Type => 1 |
SUCCESS | 0x00000000 | |
| 09:18:23,317 | 1640 | RegCloseKey |
Handle => 0x00000384 |
SUCCESS | 0x00000000 | |
| 09:18:23,317 | 1640 | NtOpenFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\History DesiredAccess => 0x00100100 FileHandle => 0x00000384 |
SUCCESS | 0x00000000 | |
| 09:18:23,317 | 1640 | NtSetInformationFile |
FileHandle => 0x00000384 FileInformation => |
SUCCESS | 0x00000000 | |
| 09:18:23,317 | 1640 | RegQueryValueExA |
Handle => 0x00000380 Data => Visited:\x00 ValueName => CachePrefix |
SUCCESS | 0x00000000 | |
| 09:18:23,317 | 1640 | RegQueryValueExA |
Handle => 0x00000380 Data => 8192 ValueName => CacheLimit |
SUCCESS | 0x00000000 | |
| 09:18:23,317 | 1640 | RegCloseKey |
Handle => 0x00000380 |
SUCCESS | 0x00000000 | |
| 09:18:23,317 | 1640 | RegCloseKey |
Handle => 0x0000037c |
SUCCESS | 0x00000000 | |
| 09:18:23,317 | 1640 | RegCloseKey |
Handle => 0x00000374 |
SUCCESS | 0x00000000 | |
| 09:18:23,317 | 1640 | RegCloseKey |
Handle => 0x00000378 |
SUCCESS | 0x00000000 | |
| 09:18:23,317 | 1640 | RegCloseKey |
Handle => 0x00000370 |
SUCCESS | 0x00000000 | |
| 09:18:23,317 | 1640 | NtOpenMutant |
Handle => 0x00000370 MutexName => _!MSFTHISTORY!_ |
SUCCESS | 0x00000000 | |
| 09:18:23,317 | 1640 | NtOpenMutant |
Handle => 0x00000378 MutexName => c:!documents and settings!tdw!local settings!temporary internet files!content.ie5! |
SUCCESS | 0x00000000 | |
| 09:18:23,317 | 1640 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => KERNEL32 |
SUCCESS | 0x00000000 | |
| 09:18:23,317 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetDiskFreeSpaceExA FunctionAddress => 0x7c83038b ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:18:23,317 | 1640 | NtOpenFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Temporary Internet Files\Content.IE5\ DesiredAccess => 0x00100001 FileHandle => 0x00000374 |
SUCCESS | 0x00000000 | |
| 09:18:23,317 | 1640 | NtOpenFile |
ShareAccess => 3 FileName => C:\ DesiredAccess => 0x00100001 FileHandle => 0x00000374 |
SUCCESS | 0x00000000 | |
| 09:18:23,317 | 1640 | NtOpenFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temporary Internet Files\Content.IE5\ DesiredAccess => 0x00100100 FileHandle => 0x00000374 |
SUCCESS | 0x00000000 | |
| 09:18:23,317 | 1640 | NtSetInformationFile |
FileHandle => 0x00000374 FileInformation => |
SUCCESS | 0x00000000 | |
| 09:18:23,317 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Temporary Internet Files\Content.IE5\index.dat DesiredAccess => 0xc0100080 CreateDisposition => 3 FileHandle => 0x00000374 |
SUCCESS | 0x00000000 | |
| 09:18:23,317 | 1640 | NtSetInformationFile |
FileHandle => 0x00000374 FileInformation => |
SUCCESS | 0x00000000 | |
| 09:18:23,317 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000374 FileInformation => \x00\xc0\x03\x00\x00\x00\x00\x00\x00\xc0\x03\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:18:23,317 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Temporary Internet Files\Content.IE5\index.dat DesiredAccess => 0xc0100080 CreateDisposition => 3 FileHandle => 0x00000374 |
SUCCESS | 0x00000000 | |
| 09:18:23,317 | 1640 | NtOpenSection |
DesiredAccess => 0x00000002 ObjectAttributes => C:\C:_Documents and Settings_TDW_Local Settings_Temporary Internet Files_Content.IE5_index.dat_245760 SectionHandle => 0x0000037c |
SUCCESS | 0x00000000 | |
| 09:18:23,317 | 1640 | ZwMapViewOfSection |
SectionOffset => 0x01fbf924 SectionHandle => 0x0000037c ProcessHandle => 0xffffffff BaseAddress => 0x02100000 |
SUCCESS | 0x00000000 | |
| 09:18:23,317 | 1640 | NtOpenMutant |
Handle => 0x00000380 MutexName => c:!documents and settings!tdw!cookies! |
SUCCESS | 0x00000000 | |
| 09:18:23,317 | 1640 | NtOpenFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Cookies\ DesiredAccess => 0x00100001 FileHandle => 0x00000384 |
SUCCESS | 0x00000000 | |
| 09:18:23,317 | 1640 | NtOpenFile |
ShareAccess => 3 FileName => C:\ DesiredAccess => 0x00100001 FileHandle => 0x00000384 |
SUCCESS | 0x00000000 | |
| 09:18:23,317 | 1640 | NtOpenFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Cookies\ DesiredAccess => 0x00100100 FileHandle => 0x00000384 |
SUCCESS | 0x00000000 | |
| 09:18:23,317 | 1640 | NtSetInformationFile |
FileHandle => 0x00000384 FileInformation => |
SUCCESS | 0x00000000 | |
| 09:18:23,317 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Cookies\index.dat DesiredAccess => 0xc0100080 CreateDisposition => 3 FileHandle => 0x00000384 |
SUCCESS | 0x00000000 | |
| 09:18:23,317 | 1640 | NtSetInformationFile |
FileHandle => 0x00000384 FileInformation => |
SUCCESS | 0x00000000 | |
| 09:18:23,317 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000384 FileInformation => \x00\x80\x00\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:18:23,317 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Cookies\index.dat DesiredAccess => 0xc0100080 CreateDisposition => 3 FileHandle => 0x00000384 |
SUCCESS | 0x00000000 | |
| 09:18:23,317 | 1640 | NtOpenSection |
DesiredAccess => 0x00000002 ObjectAttributes => C:\C:_Documents and Settings_TDW_Cookies_index.dat_32768 SectionHandle => 0x0000039c |
SUCCESS | 0x00000000 | |
| 09:18:23,317 | 1640 | ZwMapViewOfSection |
SectionOffset => 0x01fbf924 SectionHandle => 0x0000039c ProcessHandle => 0xffffffff BaseAddress => 0x02140000 |
SUCCESS | 0x00000000 | |
| 09:18:23,327 | 1640 | NtOpenMutant |
Handle => 0x00000388 MutexName => c:!documents and settings!tdw!local settings!history!history.ie5! |
SUCCESS | 0x00000000 | |
| 09:18:23,327 | 1640 | NtOpenFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\History\History.IE5\ DesiredAccess => 0x00100001 FileHandle => 0x0000038c |
SUCCESS | 0x00000000 | |
| 09:18:23,327 | 1640 | NtOpenFile |
ShareAccess => 3 FileName => C:\ DesiredAccess => 0x00100001 FileHandle => 0x0000038c |
SUCCESS | 0x00000000 | |
| 09:18:23,327 | 1640 | NtOpenFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\History\History.IE5\ DesiredAccess => 0x00100100 FileHandle => 0x0000038c |
SUCCESS | 0x00000000 | |
| 09:18:23,327 | 1640 | NtSetInformationFile |
FileHandle => 0x0000038c FileInformation => |
SUCCESS | 0x00000000 | |
| 09:18:23,327 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\History\History.IE5\index.dat DesiredAccess => 0xc0100080 CreateDisposition => 3 FileHandle => 0x0000038c |
SUCCESS | 0x00000000 | |
| 09:18:23,327 | 1640 | NtSetInformationFile |
FileHandle => 0x0000038c FileInformation => |
SUCCESS | 0x00000000 | |
| 09:18:23,327 | 1640 | NtQueryInformationFile |
FileHandle => 0x0000038c FileInformation => \x00\x80\x00\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:18:23,327 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\History\History.IE5\index.dat DesiredAccess => 0xc0100080 CreateDisposition => 3 FileHandle => 0x0000038c |
SUCCESS | 0x00000000 | |
| 09:18:23,327 | 1640 | NtOpenSection |
DesiredAccess => 0x00000002 ObjectAttributes => C:\C:_Documents and Settings_TDW_Local Settings_History_History.IE5_index.dat_32768 SectionHandle => 0x00000390 |
SUCCESS | 0x00000000 | |
| 09:18:23,327 | 1640 | ZwMapViewOfSection |
SectionOffset => 0x01fbf924 SectionHandle => 0x00000390 ProcessHandle => 0xffffffff BaseAddress => 0x02150000 |
SUCCESS | 0x00000000 | |
| 09:18:23,337 | 1640 | NtOpenFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temporary Internet Files\Content.IE5\ DesiredAccess => 0x00100100 FileHandle => 0x00000394 |
SUCCESS | 0x00000000 | |
| 09:18:23,337 | 1640 | NtSetInformationFile |
FileHandle => 0x00000394 FileInformation => |
SUCCESS | 0x00000000 | |
| 09:18:23,337 | 1640 | NtOpenFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\History\History.IE5\ DesiredAccess => 0x00100100 FileHandle => 0x00000394 |
SUCCESS | 0x00000000 | |
| 09:18:23,337 | 1640 | NtSetInformationFile |
FileHandle => 0x00000394 FileInformation => |
SUCCESS | 0x00000000 | |
| 09:18:23,337 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000374 FileInformation => \x00\xc0\x03\x00\x00\x00\x00\x00\x00\xc0\x03\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:18:23,337 | 1640 | RegOpenKeyExA |
Handle => 0x00000394 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache |
SUCCESS | 0x00000000 | |
| 09:18:23,337 | 1640 | RegOpenKeyExA |
Handle => 0x00000398 Registry => 0x00000394 SubKey => Extensible Cache |
SUCCESS | 0x00000000 | |
| 09:18:23,337 | 1640 | RegCloseKey |
Handle => 0x00000394 |
SUCCESS | 0x00000000 | |
| 09:18:23,337 | 1640 | RegEnumKeyExA |
Index => 0 Handle => 0x00000398 Name => MSHist012014071820140719 Class => |
SUCCESS | 0x00000000 | |
| 09:18:23,337 | 1640 | RegOpenKeyExA |
Handle => 0x00000394 Registry => 0x00000398 SubKey => MSHist012014071820140719 |
SUCCESS | 0x00000000 | |
| 09:18:23,337 | 1640 | RegQueryValueExA |
Handle => 0x00000394 Data => 0 ValueName => CacheRepair |
SUCCESS | 0x00000000 | |
| 09:18:23,337 | 1640 | RegQueryValueExA |
Handle => 0x00000394 Data => %USERPROFILE%\Local Settings\History\History.IE5\MSHist012014071820140719\\x00 ValueName => CachePath |
SUCCESS | 0x00000000 | |
| 09:18:23,337 | 1640 | RegQueryValueExA |
Handle => 0x00000394 Data => :2014071820140719: \x00 ValueName => CachePrefix |
SUCCESS | 0x00000000 | |
| 09:18:23,337 | 1640 | RegQueryValueExA |
Handle => 0x00000394 Data => 8192 ValueName => CacheLimit |
SUCCESS | 0x00000000 | |
| 09:18:23,337 | 1640 | RegQueryValueExA |
Handle => 0x00000394 Data => 11 ValueName => CacheOptions |
SUCCESS | 0x00000000 | |
| 09:18:23,337 | 1640 | RegCloseKey |
Handle => 0x00000394 |
SUCCESS | 0x00000000 | |
| 09:18:23,337 | 1640 | RegEnumKeyExA |
Index => 1 Handle => 0x00000398 Name => MSHist012014071820140719 Class => |
FAILURE | 0x00000103 | |
| 09:18:23,337 | 1640 | RegCloseKey |
Handle => 0x00000398 |
SUCCESS | 0x00000000 | |
| 09:18:23,337 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000374 FileInformation => \x00\xc0\x03\x00\x00\x00\x00\x00\x00\xc0\x03\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | 1 time |
| 09:18:23,337 | 1640 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000001 SubKey => SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings |
FAILURE | 0x00000002 | |
| 09:18:23,337 | 1640 | RegOpenKeyExW |
Handle => 0x00000398 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:18:23,347 | 1640 | RegQueryValueExW |
Handle => 0x00000398 DataLength => 4 ValueName => Security_HKLM_only Type => 33290524 |
FAILURE | 0x00000002 | |
| 09:18:23,347 | 1640 | RegCloseKey |
Handle => 0x00000398 |
SUCCESS | 0x00000000 | |
| 09:18:23,347 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:18:23,347 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:18:23,347 | 1640 | RegOpenKeyExW |
Handle => 0x00000398 Registry => 0x80000002 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
SUCCESS | 0x00000000 | |
| 09:18:23,347 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:18:23,347 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x00000398 SubKey => FEATURE_AUTOPROXY_CACHE_ANAME_KB921400 |
FAILURE | 0x00000002 | |
| 09:18:23,347 | 1640 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | 1 time |
| 09:18:23,347 | 1640 | RegCloseKey |
Handle => 0x00000398 |
SUCCESS | 0x00000000 | |
| 09:18:23,347 | 1640 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | |
| 09:18:23,347 | 1640 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000001 SubKey => SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings |
FAILURE | 0x00000002 | 2 times |
| 09:18:23,347 | 1640 | RegOpenKeyExW |
Handle => 0x00000398 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:18:23,347 | 1640 | RegQueryValueExW |
Handle => 0x00000398 DataLength => 4 ValueName => Security_HKLM_only Type => 33290524 |
FAILURE | 0x00000002 | |
| 09:18:23,347 | 1640 | RegCloseKey |
Handle => 0x00000398 |
SUCCESS | 0x00000000 | |
| 09:18:23,347 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:18:23,347 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:18:23,347 | 1640 | RegOpenKeyExW |
Handle => 0x00000398 Registry => 0x80000002 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
SUCCESS | 0x00000000 | |
| 09:18:23,347 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:18:23,347 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x00000398 SubKey => FEATURE_TEMPORARYFILES_FOR_NOCACHE_840387 |
FAILURE | 0x00000002 | |
| 09:18:23,347 | 1640 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | 1 time |
| 09:18:23,347 | 1640 | RegCloseKey |
Handle => 0x00000398 |
SUCCESS | 0x00000000 | |
| 09:18:23,347 | 1640 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | |
| 09:18:23,347 | 1640 | RegOpenKeyExW |
Handle => 0x00000398 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:18:23,347 | 1640 | RegQueryValueExW |
Handle => 0x00000398 DataLength => 4 ValueName => Security_HKLM_only Type => 33290524 |
FAILURE | 0x00000002 | |
| 09:18:23,347 | 1640 | RegCloseKey |
Handle => 0x00000398 |
SUCCESS | 0x00000000 | |
| 09:18:23,347 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:18:23,347 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:18:23,357 | 1640 | RegOpenKeyExW |
Handle => 0x00000398 Registry => 0x80000002 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
SUCCESS | 0x00000000 | |
| 09:18:23,357 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:18:23,357 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x00000398 SubKey => FEATURE_TEMPORARYFILES_FOR_NOCACHE_840386 |
FAILURE | 0x00000002 | |
| 09:18:23,357 | 1640 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | 1 time |
| 09:18:23,357 | 1640 | RegCloseKey |
Handle => 0x00000398 |
SUCCESS | 0x00000000 | |
| 09:18:23,357 | 1640 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | |
| 09:18:23,357 | 1640 | RegOpenKeyExW |
Handle => 0x00000398 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:18:23,357 | 1640 | RegQueryValueExW |
Handle => 0x00000398 DataLength => 4 ValueName => Security_HKLM_only Type => 33290520 |
FAILURE | 0x00000002 | |
| 09:18:23,357 | 1640 | RegCloseKey |
Handle => 0x00000398 |
SUCCESS | 0x00000000 | |
| 09:18:23,357 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:18:23,357 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:18:23,357 | 1640 | RegOpenKeyExW |
Handle => 0x00000398 Registry => 0x80000002 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
SUCCESS | 0x00000000 | |
| 09:18:23,357 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:18:23,357 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x00000398 SubKey => RETRY_HEADERONLYPOST_ONCONNECTIONRESET |
FAILURE | 0x00000002 | |
| 09:18:23,357 | 1640 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | 1 time |
| 09:18:23,357 | 1640 | RegCloseKey |
Handle => 0x00000398 |
SUCCESS | 0x00000000 | |
| 09:18:23,357 | 1640 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | |
| 09:18:23,357 | 1640 | RegOpenKeyExW |
Handle => 0x00000398 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:18:23,357 | 1640 | RegQueryValueExW |
Handle => 0x00000398 DataLength => 4 ValueName => Security_HKLM_only Type => 33290524 |
FAILURE | 0x00000002 | |
| 09:18:23,357 | 1640 | RegCloseKey |
Handle => 0x00000398 |
SUCCESS | 0x00000000 | |
| 09:18:23,357 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:18:23,357 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:18:23,357 | 1640 | RegOpenKeyExW |
Handle => 0x00000398 Registry => 0x80000002 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
SUCCESS | 0x00000000 | |
| 09:18:23,357 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:18:23,357 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x00000398 SubKey => FEATURE_CHUNK_TIMEOUT_KB914453 |
FAILURE | 0x00000002 | |
| 09:18:23,357 | 1640 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | 1 time |
| 09:18:23,357 | 1640 | RegCloseKey |
Handle => 0x00000398 |
SUCCESS | 0x00000000 | |
| 09:18:23,357 | 1640 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | |
| 09:18:23,357 | 1640 | RegOpenKeyExW |
Handle => 0x00000398 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:18:23,357 | 1640 | RegQueryValueExW |
Handle => 0x00000398 DataLength => 4 ValueName => Security_HKLM_only Type => 33290524 |
FAILURE | 0x00000002 | |
| 09:18:23,357 | 1640 | RegCloseKey |
Handle => 0x00000398 |
SUCCESS | 0x00000000 | |
| 09:18:23,357 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:18:23,357 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:18:23,357 | 1640 | RegOpenKeyExW |
Handle => 0x00000398 Registry => 0x80000002 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
SUCCESS | 0x00000000 | |
| 09:18:23,357 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:18:23,357 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x00000398 SubKey => FEATURE_CERT_TRUST_VERIFIED_KB936882 |
FAILURE | 0x00000002 | |
| 09:18:23,357 | 1640 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | 1 time |
| 09:18:23,357 | 1640 | RegCloseKey |
Handle => 0x00000398 |
SUCCESS | 0x00000000 | |
| 09:18:23,357 | 1640 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | |
| 09:18:23,357 | 1640 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000001 SubKey => SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings |
FAILURE | 0x00000002 | |
| 09:18:23,357 | 1640 | RegOpenKeyExA |
Handle => 0x00000398 Registry => 0x80000002 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:18:23,357 | 1640 | RegQueryValueExA |
Handle => 0x00000398 DataLength => 4 ValueName => DisableWorkerThreadHibernation Type => 920 |
FAILURE | 0x00000002 | |
| 09:18:23,357 | 1640 | RegCloseKey |
Handle => 0x00000398 |
SUCCESS | 0x00000000 | |
| 09:18:23,357 | 1640 | RegQueryValueExA |
Handle => 0x00000354 DataLength => 4 ValueName => DisableWorkerThreadHibernation Type => 852 |
FAILURE | 0x00000002 | |
| 09:18:23,357 | 1640 | RegQueryValueExA |
Handle => 0x00000354 DataLength => 4 ValueName => DisableReadRange Type => 852 |
FAILURE | 0x00000002 | |
| 09:18:23,357 | 1640 | RegQueryValueExA |
Handle => 0x00000354 DataLength => 4 ValueName => SocketSendBufferLength Type => 852 |
FAILURE | 0x00000002 | |
| 09:18:23,357 | 1640 | RegQueryValueExA |
Handle => 0x00000354 DataLength => 4 ValueName => SocketReceiveBufferLength Type => 852 |
FAILURE | 0x00000002 | |
| 09:18:23,357 | 1640 | RegQueryValueExA |
Handle => 0x00000354 DataLength => 4 ValueName => KeepAliveTimeout Type => 852 |
FAILURE | 0x00000002 | |
| 09:18:23,357 | 1640 | RegQueryValueExA |
Handle => 0x00000354 DataLength => 4 ValueName => MaxHttpRedirects Type => 852 |
FAILURE | 0x00000002 | |
| 09:18:23,357 | 1640 | RegQueryValueExA |
Handle => 0x00000354 DataLength => 4 ValueName => MaxConnectionsPerServer Type => 852 |
FAILURE | 0x00000002 | |
| 09:18:23,357 | 1640 | RegQueryValueExA |
Handle => 0x00000354 DataLength => 4 ValueName => MaxConnectionsPer1_0Server Type => 852 |
FAILURE | 0x00000002 | |
| 09:18:23,357 | 1640 | RegQueryValueExA |
Handle => 0x00000354 DataLength => 4 ValueName => ServerInfoTimeout Type => 852 |
FAILURE | 0x00000002 | |
| 09:18:23,357 | 1640 | RegQueryValueExA |
Handle => 0x00000354 DataLength => 4 ValueName => ReceiveTimeOut Type => 852 |
FAILURE | 0x00000002 | |
| 09:18:23,357 | 1640 | RegQueryValueExA |
Handle => 0x00000354 DataLength => 4 ValueName => DisableNTLMPreAuth Type => 852 |
FAILURE | 0x00000002 | |
| 09:18:23,357 | 1640 | RegQueryValueExA |
Handle => 0x00000354 DataLength => 4 ValueName => ScavengeCacheLowerBound Type => 852 |
FAILURE | 0x00000002 | |
| 09:18:23,357 | 1640 | RegQueryValueExA |
Handle => 0x00000354 DataLength => 4 ValueName => CertCacheNoValidate Type => 852 |
FAILURE | 0x00000002 | |
| 09:18:23,357 | 1640 | RegOpenKeyExA |
Handle => 0x00000398 Registry => 0x80000001 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache |
SUCCESS | 0x00000000 | |
| 09:18:23,357 | 1640 | RegQueryValueExA |
Handle => 0x00000398 DataLength => 4 ValueName => ScavengeCacheFileLifeTime Type => 920 |
FAILURE | 0x00000002 | |
| 09:18:23,357 | 1640 | RegCloseKey |
Handle => 0x00000398 |
SUCCESS | 0x00000000 | |
| 09:18:23,357 | 1640 | RegOpenKeyExA |
Handle => 0x00000398 Registry => 0x80000002 SubKey => SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:18:23,357 | 1640 | RegQueryValueExA |
Handle => 0x00000398 DataLength => 4 ValueName => Security_HKLM_only Type => 920 |
FAILURE | 0x00000002 | |
| 09:18:23,357 | 1640 | RegCloseKey |
Handle => 0x00000398 |
SUCCESS | 0x00000000 | |
| 09:18:23,357 | 1640 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000002 SubKey => SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache |
FAILURE | 0x00000002 | |
| 09:18:23,357 | 1640 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000001 SubKey => SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache |
FAILURE | 0x00000002 | |
| 09:18:23,357 | 1640 | RegOpenKeyExA |
Handle => 0x00000398 Registry => 0x80000002 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache |
SUCCESS | 0x00000000 | |
| 09:18:23,357 | 1640 | RegOpenKeyExA |
Handle => 0x00000394 Registry => 0x80000001 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache |
SUCCESS | 0x00000000 | |
| 09:18:23,357 | 1640 | RegQueryValueExA |
Handle => 0x00000394 DataLength => 4 ValueName => ScavengeCacheFileLimit Type => 916 |
FAILURE | 0x00000002 | |
| 09:18:23,357 | 1640 | RegQueryValueExA |
Handle => 0x00000398 DataLength => 4 ValueName => ScavengeCacheFileLimit Type => 920 |
FAILURE | 0x00000002 | |
| 09:18:23,357 | 1640 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | 1 time |
| 09:18:23,357 | 1640 | RegCloseKey |
Handle => 0x00000398 |
SUCCESS | 0x00000000 | |
| 09:18:23,357 | 1640 | RegCloseKey |
Handle => 0x00000394 |
SUCCESS | 0x00000000 | |
| 09:18:23,357 | 1640 | RegOpenKeyExW |
Handle => 0x00000394 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:18:23,357 | 1640 | RegQueryValueExW |
Handle => 0x00000394 DataLength => 4 ValueName => Security_HKLM_only Type => 33290524 |
FAILURE | 0x00000002 | |
| 09:18:23,357 | 1640 | RegCloseKey |
Handle => 0x00000394 |
SUCCESS | 0x00000000 | |
| 09:18:23,357 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:18:23,357 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:18:23,357 | 1640 | RegOpenKeyExW |
Handle => 0x00000394 Registry => 0x80000002 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
SUCCESS | 0x00000000 | |
| 09:18:23,357 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:18:23,357 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x00000394 SubKey => FEATURE_BUFFERBREAKING_818408 |
FAILURE | 0x00000002 | |
| 09:18:23,357 | 1640 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | 1 time |
| 09:18:23,357 | 1640 | RegCloseKey |
Handle => 0x00000394 |
SUCCESS | 0x00000000 | |
| 09:18:23,357 | 1640 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | |
| 09:18:23,357 | 1640 | RegOpenKeyExW |
Handle => 0x00000394 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:18:23,357 | 1640 | RegQueryValueExW |
Handle => 0x00000394 DataLength => 4 ValueName => Security_HKLM_only Type => 33290524 |
FAILURE | 0x00000002 | |
| 09:18:23,357 | 1640 | RegCloseKey |
Handle => 0x00000394 |
SUCCESS | 0x00000000 | |
| 09:18:23,357 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:18:23,357 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:18:23,357 | 1640 | RegOpenKeyExW |
Handle => 0x00000394 Registry => 0x80000002 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
SUCCESS | 0x00000000 | |
| 09:18:23,357 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:18:23,357 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x00000394 SubKey => FEATURE_SKIP_POST_RETRY_ON_INTERNETWRITEFILE_KB895954 |
FAILURE | 0x00000002 | |
| 09:18:23,357 | 1640 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | 1 time |
| 09:18:23,357 | 1640 | RegCloseKey |
Handle => 0x00000394 |
SUCCESS | 0x00000000 | |
| 09:18:23,357 | 1640 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | |
| 09:18:23,357 | 1640 | RegOpenKeyExW |
Handle => 0x00000394 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:18:23,357 | 1640 | RegQueryValueExW |
Handle => 0x00000394 DataLength => 4 ValueName => Security_HKLM_only Type => 33290524 |
FAILURE | 0x00000002 | |
| 09:18:23,357 | 1640 | RegCloseKey |
Handle => 0x00000394 |
SUCCESS | 0x00000000 | |
| 09:18:23,357 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:18:23,357 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:18:23,357 | 1640 | RegOpenKeyExW |
Handle => 0x00000394 Registry => 0x80000002 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
SUCCESS | 0x00000000 | |
| 09:18:23,357 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:18:23,357 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x00000394 SubKey => FEATURE_ENSURE_FQDN_FOR_NEGOTIATE_KB899417 |
FAILURE | 0x00000002 | |
| 09:18:23,357 | 1640 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | 1 time |
| 09:18:23,357 | 1640 | RegCloseKey |
Handle => 0x00000394 |
SUCCESS | 0x00000000 | |
| 09:18:23,357 | 1640 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | |
| 09:18:23,357 | 1640 | RegOpenKeyExW |
Handle => 0x00000394 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:18:23,357 | 1640 | RegQueryValueExW |
Handle => 0x00000394 DataLength => 4 ValueName => Security_HKLM_only Type => 33290524 |
FAILURE | 0x00000002 | |
| 09:18:23,357 | 1640 | RegCloseKey |
Handle => 0x00000394 |
SUCCESS | 0x00000000 | |
| 09:18:23,357 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:18:23,357 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:18:23,357 | 1640 | RegOpenKeyExW |
Handle => 0x00000394 Registry => 0x80000002 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
SUCCESS | 0x00000000 | |
| 09:18:23,357 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:18:23,357 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x00000394 SubKey => FEATURE_HTTP_DISABLE_NTLM_PREAUTH_IF_ABORTED_KB902409 |
FAILURE | 0x00000002 | |
| 09:18:23,357 | 1640 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | 1 time |
| 09:18:23,357 | 1640 | RegCloseKey |
Handle => 0x00000394 |
SUCCESS | 0x00000000 | |
| 09:18:23,357 | 1640 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | |
| 09:18:23,357 | 1640 | RegOpenKeyExW |
Handle => 0x00000394 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:18:23,357 | 1640 | RegQueryValueExW |
Handle => 0x00000394 DataLength => 4 ValueName => Security_HKLM_only Type => 33290524 |
FAILURE | 0x00000002 | |
| 09:18:23,357 | 1640 | RegCloseKey |
Handle => 0x00000394 |
SUCCESS | 0x00000000 | |
| 09:18:23,357 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:18:23,357 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:18:23,357 | 1640 | RegOpenKeyExW |
Handle => 0x00000394 Registry => 0x80000002 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
SUCCESS | 0x00000000 | |
| 09:18:23,357 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:18:23,357 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x00000394 SubKey => FEATURE_PERMIT_CACHE_FOR_AUTHENTICATED_FTP_KB910274 |
FAILURE | 0x00000002 | |
| 09:18:23,357 | 1640 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | 1 time |
| 09:18:23,357 | 1640 | RegCloseKey |
Handle => 0x00000394 |
SUCCESS | 0x00000000 | |
| 09:18:23,357 | 1640 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | |
| 09:18:23,357 | 1640 | RegOpenKeyExW |
Handle => 0x00000394 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:18:23,357 | 1640 | RegQueryValueExW |
Handle => 0x00000394 DataLength => 4 ValueName => Security_HKLM_only Type => 33290524 |
FAILURE | 0x00000002 | |
| 09:18:23,357 | 1640 | RegCloseKey |
Handle => 0x00000394 |
SUCCESS | 0x00000000 | |
| 09:18:23,357 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:18:23,357 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:18:23,357 | 1640 | RegOpenKeyExW |
Handle => 0x00000394 Registry => 0x80000002 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
SUCCESS | 0x00000000 | |
| 09:18:23,357 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:18:23,357 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x00000394 SubKey => FEATURE_WPAD_STORE_URL_AS_FQDN_KB903926 |
FAILURE | 0x00000002 | |
| 09:18:23,357 | 1640 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | 1 time |
| 09:18:23,357 | 1640 | RegCloseKey |
Handle => 0x00000394 |
SUCCESS | 0x00000000 | |
| 09:18:23,357 | 1640 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | |
| 09:18:23,357 | 1640 | RegOpenKeyExW |
Handle => 0x00000394 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:18:23,357 | 1640 | RegQueryValueExW |
Handle => 0x00000394 DataLength => 4 ValueName => Security_HKLM_only Type => 33290524 |
FAILURE | 0x00000002 | |
| 09:18:23,357 | 1640 | RegCloseKey |
Handle => 0x00000394 |
SUCCESS | 0x00000000 | |
| 09:18:23,357 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:18:23,357 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:18:23,357 | 1640 | RegOpenKeyExW |
Handle => 0x00000394 Registry => 0x80000002 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
SUCCESS | 0x00000000 | |
| 09:18:23,357 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:18:23,357 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x00000394 SubKey => FEATURE_USE_CNAME_FOR_SPN_KB911149 |
FAILURE | 0x00000002 | |
| 09:18:23,357 | 1640 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | 1 time |
| 09:18:23,357 | 1640 | RegCloseKey |
Handle => 0x00000394 |
SUCCESS | 0x00000000 | |
| 09:18:23,357 | 1640 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | |
| 09:18:23,357 | 1640 | RegOpenKeyExW |
Handle => 0x00000394 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:18:23,357 | 1640 | RegQueryValueExW |
Handle => 0x00000394 DataLength => 4 ValueName => Security_HKLM_only Type => 33290524 |
FAILURE | 0x00000002 | |
| 09:18:23,357 | 1640 | RegCloseKey |
Handle => 0x00000394 |
SUCCESS | 0x00000000 | |
| 09:18:23,357 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:18:23,357 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:18:23,357 | 1640 | RegOpenKeyExW |
Handle => 0x00000394 Registry => 0x80000002 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
SUCCESS | 0x00000000 | |
| 09:18:23,357 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:18:23,357 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x00000394 SubKey => FEATURE_KEEP_CACHE_INDEX_OPEN_KB899342 |
FAILURE | 0x00000002 | |
| 09:18:23,357 | 1640 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | 1 time |
| 09:18:23,357 | 1640 | RegCloseKey |
Handle => 0x00000394 |
SUCCESS | 0x00000000 | |
| 09:18:23,357 | 1640 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | |
| 09:18:23,357 | 1640 | RegOpenKeyExW |
Handle => 0x00000394 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:18:23,357 | 1640 | RegQueryValueExW |
Handle => 0x00000394 DataLength => 4 ValueName => Security_HKLM_only Type => 33290524 |
FAILURE | 0x00000002 | |
| 09:18:23,357 | 1640 | RegCloseKey |
Handle => 0x00000394 |
SUCCESS | 0x00000000 | |
| 09:18:23,357 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:18:23,357 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:18:23,357 | 1640 | RegOpenKeyExW |
Handle => 0x00000394 Registry => 0x80000002 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
SUCCESS | 0x00000000 | |
| 09:18:23,357 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:18:23,357 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x00000394 SubKey => FEATURE_WAIT_TIME_THREAD_TERMINATE_KB886801 |
FAILURE | 0x00000002 | |
| 09:18:23,357 | 1640 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | 1 time |
| 09:18:23,357 | 1640 | RegCloseKey |
Handle => 0x00000394 |
SUCCESS | 0x00000000 | |
| 09:18:23,357 | 1640 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | |
| 09:18:23,357 | 1640 | RegOpenKeyExW |
Handle => 0x00000394 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:18:23,357 | 1640 | RegQueryValueExW |
Handle => 0x00000394 DataLength => 4 ValueName => Security_HKLM_only Type => 33290524 |
FAILURE | 0x00000002 | |
| 09:18:23,357 | 1640 | RegCloseKey |
Handle => 0x00000394 |
SUCCESS | 0x00000000 | |
| 09:18:23,357 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:18:23,357 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:18:23,357 | 1640 | RegOpenKeyExW |
Handle => 0x00000394 Registry => 0x80000002 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
SUCCESS | 0x00000000 | |
| 09:18:23,357 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:18:23,357 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x00000394 SubKey => FEATURE_FIX_CHUNKED_PROXY_SCRIPT_DOWNLOAD_KB843289 |
FAILURE | 0x00000002 | |
| 09:18:23,357 | 1640 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | 1 time |
| 09:18:23,357 | 1640 | RegCloseKey |
Handle => 0x00000394 |
SUCCESS | 0x00000000 | |
| 09:18:23,357 | 1640 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | |
| 09:18:23,357 | 1640 | RegQueryValueExA |
Handle => 0x00000354 DataLength => 4 ValueName => HttpDefaultExpiryTimeSecs Type => 852 |
FAILURE | 0x00000002 | |
| 09:18:23,357 | 1640 | RegQueryValueExA |
Handle => 0x00000354 DataLength => 4 ValueName => FtpDefaultExpiryTimeSecs Type => 852 |
FAILURE | 0x00000002 | |
| 09:18:23,357 | 1640 | RegQueryValueExA |
Handle => 0x00000354 DataLength => 4 ValueName => GopherDefaultExpiryTimeSecs Type => 852 |
FAILURE | 0x00000002 | |
| 09:18:23,357 | 1640 | RegQueryValueExA |
Handle => 0x00000354 DataLength => 4 ValueName => DisableCachingOfSSLPages Type => 852 |
FAILURE | 0x00000002 | |
| 09:18:23,357 | 1640 | RegQueryValueExA |
Handle => 0x00000354 DataLength => 4 ValueName => PerUserCookies Type => 852 |
FAILURE | 0x00000002 | |
| 09:18:23,357 | 1640 | RegQueryValueExA |
Handle => 0x00000354 DataLength => 4 ValueName => LeashLegacyCookies Type => 852 |
FAILURE | 0x00000002 | |
| 09:18:23,357 | 1640 | RegQueryValueExA |
Handle => 0x00000354 DataLength => 4 ValueName => DisableNT4RasCheck Type => 852 |
FAILURE | 0x00000002 | |
| 09:18:23,357 | 1640 | RegOpenKeyExA |
Handle => 0x00000394 Registry => 0x80000001 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:18:23,357 | 1640 | RegQueryValueExA |
Handle => 0x00000394 DataLength => 4 ValueName => DialupUseLanSettings Type => 916 |
FAILURE | 0x00000002 | |
| 09:18:23,357 | 1640 | RegOpenKeyExA |
Handle => 0x00000398 Registry => 0x80000002 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:18:23,357 | 1640 | RegQueryValueExA |
Handle => 0x00000398 DataLength => 4 ValueName => DialupUseLanSettings Type => 920 |
FAILURE | 0x00000002 | |
| 09:18:23,357 | 1640 | RegCloseKey |
Handle => 0x00000398 |
SUCCESS | 0x00000000 | |
| 09:18:23,357 | 1640 | RegCloseKey |
Handle => 0x00000394 |
SUCCESS | 0x00000000 | |
| 09:18:23,357 | 1640 | RegQueryValueExA |
Handle => 0x00000354 DataLength => 4 ValueName => SendExtraCRLF Type => 852 |
FAILURE | 0x00000002 | |
| 09:18:23,357 | 1640 | RegQueryValueExA |
Handle => 0x00000354 DataLength => 4 ValueName => BypassFtpTimeCheck Type => 852 |
FAILURE | 0x00000002 | |
| 09:18:23,357 | 1640 | RegQueryValueExA |
Handle => 0x00000354 DataLength => 4 ValueName => EnableGopher Type => 852 |
FAILURE | 0x00000002 | |
| 09:18:23,357 | 1640 | RegQueryValueExA |
Handle => 0x00000354 DataLength => 4 ValueName => ReleaseSocketDuringAuth Type => 852 |
FAILURE | 0x00000002 | |
| 09:18:23,357 | 1640 | RegOpenKeyExA |
Handle => 0x00000394 Registry => 0x80000001 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:18:23,357 | 1640 | RegQueryValueExA |
Handle => 0x00000394 DataLength => 4 ValueName => ReleaseSocketDuring401Auth Type => 916 |
FAILURE | 0x00000002 | |
| 09:18:23,357 | 1640 | RegOpenKeyExA |
Handle => 0x00000398 Registry => 0x80000002 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:18:23,357 | 1640 | RegQueryValueExA |
Handle => 0x00000398 DataLength => 4 ValueName => ReleaseSocketDuring401Auth Type => 920 |
FAILURE | 0x00000002 | |
| 09:18:23,357 | 1640 | RegCloseKey |
Handle => 0x00000398 |
SUCCESS | 0x00000000 | |
| 09:18:23,357 | 1640 | RegCloseKey |
Handle => 0x00000394 |
SUCCESS | 0x00000000 | |
| 09:18:23,357 | 1640 | RegQueryValueExA |
Handle => 0x00000354 DataLength => 4 ValueName => WpadSearchAllDomains Type => 852 |
FAILURE | 0x00000002 | |
| 09:18:23,357 | 1640 | RegOpenKeyExA |
Handle => 0x00000394 Registry => 0x80000001 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:18:23,357 | 1640 | RegQueryValueExA |
Handle => 0x00000394 DataLength => 4 ValueName => DisableLegacyPreAuthAsServer Type => 916 |
FAILURE | 0x00000002 | |
| 09:18:23,357 | 1640 | RegOpenKeyExA |
Handle => 0x00000398 Registry => 0x80000002 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:18:23,367 | 1640 | RegQueryValueExA |
Handle => 0x00000398 DataLength => 4 ValueName => DisableLegacyPreAuthAsServer Type => 920 |
FAILURE | 0x00000002 | |
| 09:18:23,367 | 1640 | RegCloseKey |
Handle => 0x00000398 |
SUCCESS | 0x00000000 | |
| 09:18:23,367 | 1640 | RegCloseKey |
Handle => 0x00000394 |
SUCCESS | 0x00000000 | |
| 09:18:23,367 | 1640 | RegOpenKeyExA |
Handle => 0x00000394 Registry => 0x80000001 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:18:23,367 | 1640 | RegQueryValueExA |
Handle => 0x00000394 DataLength => 4 ValueName => BypassHTTPNoCacheCheck Type => 916 |
FAILURE | 0x00000002 | |
| 09:18:23,367 | 1640 | RegOpenKeyExA |
Handle => 0x00000398 Registry => 0x80000002 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:18:23,367 | 1640 | RegQueryValueExA |
Handle => 0x00000398 DataLength => 4 ValueName => BypassHTTPNoCacheCheck Type => 920 |
FAILURE | 0x00000002 | |
| 09:18:23,367 | 1640 | RegCloseKey |
Handle => 0x00000398 |
SUCCESS | 0x00000000 | |
| 09:18:23,367 | 1640 | RegCloseKey |
Handle => 0x00000394 |
SUCCESS | 0x00000000 | |
| 09:18:23,367 | 1640 | RegOpenKeyExA |
Handle => 0x00000394 Registry => 0x80000001 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:18:23,367 | 1640 | RegQueryValueExA |
Handle => 0x00000394 DataLength => 4 ValueName => BypassSSLNoCacheCheck Type => 916 |
FAILURE | 0x00000002 | |
| 09:18:23,367 | 1640 | RegOpenKeyExA |
Handle => 0x00000398 Registry => 0x80000002 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:18:23,367 | 1640 | RegQueryValueExA |
Handle => 0x00000398 DataLength => 4 ValueName => BypassSSLNoCacheCheck Type => 920 |
FAILURE | 0x00000002 | |
| 09:18:23,367 | 1640 | RegCloseKey |
Handle => 0x00000398 |
SUCCESS | 0x00000000 | |
| 09:18:23,367 | 1640 | RegCloseKey |
Handle => 0x00000394 |
SUCCESS | 0x00000000 | |
| 09:18:23,367 | 1640 | RegOpenKeyExA |
Handle => 0x00000394 Registry => 0x80000001 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:18:23,367 | 1640 | RegQueryValueExA |
Handle => 0x00000394 DataLength => 4 ValueName => EnableHttpTrace Type => 916 |
FAILURE | 0x00000002 | |
| 09:18:23,367 | 1640 | RegOpenKeyExA |
Handle => 0x00000398 Registry => 0x80000002 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:18:23,367 | 1640 | RegQueryValueExA |
Handle => 0x00000398 DataLength => 4 ValueName => EnableHttpTrace Type => 920 |
FAILURE | 0x00000002 | |
| 09:18:23,367 | 1640 | RegCloseKey |
Handle => 0x00000398 |
SUCCESS | 0x00000000 | |
| 09:18:23,367 | 1640 | RegCloseKey |
Handle => 0x00000394 |
SUCCESS | 0x00000000 | |
| 09:18:23,367 | 1640 | RegOpenKeyExA |
Handle => 0x00000394 Registry => 0x80000001 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:18:23,367 | 1640 | RegQueryValueExA |
Handle => 0x00000394 DataLength => 4 ValueName => NoCheckAutodialOverRide Type => 916 |
FAILURE | 0x00000002 | |
| 09:18:23,367 | 1640 | RegOpenKeyExA |
Handle => 0x00000398 Registry => 0x80000002 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:18:23,367 | 1640 | RegQueryValueExA |
Handle => 0x00000398 DataLength => 4 ValueName => NoCheckAutodialOverRide Type => 920 |
FAILURE | 0x00000002 | |
| 09:18:23,367 | 1640 | RegCloseKey |
Handle => 0x00000398 |
SUCCESS | 0x00000000 | |
| 09:18:23,367 | 1640 | RegCloseKey |
Handle => 0x00000394 |
SUCCESS | 0x00000000 | |
| 09:18:23,367 | 1640 | RegOpenKeyExA |
Handle => 0x00000394 Registry => 0x80000002 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:18:23,367 | 1640 | RegQueryValueExA |
Handle => 0x00000394 DataLength => 4 ValueName => DontUseDNSLoadBalancing Type => 916 |
FAILURE | 0x00000002 | |
| 09:18:23,367 | 1640 | RegCloseKey |
Handle => 0x00000394 |
SUCCESS | 0x00000000 | |
| 09:18:23,367 | 1640 | RegQueryValueExA |
Handle => 0x00000354 DataLength => 4 ValueName => DontUseDNSLoadBalancing Type => 852 |
FAILURE | 0x00000002 | |
| 09:18:23,367 | 1640 | RegQueryValueExA |
Handle => 0x00000354 DataLength => 4 ValueName => NonBlockingClient32 Type => 852 |
FAILURE | 0x00000002 | |
| 09:18:23,367 | 1640 | RegOpenKeyExA |
Handle => 0x00000394 Registry => 0x80000002 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:18:23,367 | 1640 | RegQueryValueExA |
Handle => 0x00000394 DataLength => 4 ValueName => ShareCredsWithWinHttp Type => 916 |
FAILURE | 0x00000002 | |
| 09:18:23,367 | 1640 | RegCloseKey |
Handle => 0x00000394 |
SUCCESS | 0x00000000 | |
| 09:18:23,367 | 1640 | RegQueryValueExA |
Handle => 0x00000354 DataLength => 66 ValueName => MimeExclusionListForCache Type => 1 |
SUCCESS | 0x00000000 | |
| 09:18:23,367 | 1640 | RegQueryValueExA |
Handle => 0x00000354 Data => multipart/mixed multipart/x-mixed-replace multipart/x-byteranges \x00 ValueName => MimeExclusionListForCache |
SUCCESS | 0x00000000 | |
| 09:18:23,367 | 1640 | RegQueryValueExA |
Handle => 0x00000354 DataLength => 0 ValueName => HeaderExclusionListForCache Type => 852 |
FAILURE | 0x00000002 | |
| 09:18:23,367 | 1640 | RegQueryValueExA |
Handle => 0x00000354 DataLength => 4 ValueName => DnsCacheEnabled Type => 852 |
FAILURE | 0x00000002 | |
| 09:18:23,367 | 1640 | RegQueryValueExA |
Handle => 0x00000354 DataLength => 4 ValueName => DnsCacheEntries Type => 852 |
FAILURE | 0x00000002 | |
| 09:18:23,367 | 1640 | RegQueryValueExA |
Handle => 0x00000354 DataLength => 4 ValueName => DnsCacheTimeout Type => 852 |
FAILURE | 0x00000002 | |
| 09:18:23,367 | 1640 | RegQueryValueExA |
Handle => 0x00000354 Data => ValueName => WarnOnPost |
SUCCESS | 0x00000000 | |
| 09:18:23,367 | 1640 | RegQueryValueExA |
Handle => 0x00000354 DataLength => 4 ValueName => WarnAlwaysOnPost Type => 852 |
FAILURE | 0x00000002 | |
| 09:18:23,367 | 1640 | RegQueryValueExA |
Handle => 0x00000354 Data => 0 ValueName => WarnOnZoneCrossing |
SUCCESS | 0x00000000 | |
| 09:18:23,367 | 1640 | RegQueryValueExA |
Handle => 0x00000354 DataLength => 4 ValueName => WarnOnBadCertSending Type => 852 |
FAILURE | 0x00000002 | |
| 09:18:23,367 | 1640 | RegQueryValueExA |
Handle => 0x00000354 DataLength => 4 ValueName => WarnOnBadCertRecving Type => 852 |
FAILURE | 0x00000002 | |
| 09:18:23,367 | 1640 | RegQueryValueExA |
Handle => 0x00000354 DataLength => 4 ValueName => WarnOnPostRedirect Type => 852 |
FAILURE | 0x00000002 | |
| 09:18:23,367 | 1640 | RegQueryValueExA |
Handle => 0x00000354 DataLength => 4 ValueName => AlwaysDrainOnRedirect Type => 852 |
FAILURE | 0x00000002 | |
| 09:18:23,367 | 1640 | RegQueryValueExA |
Handle => 0x00000354 DataLength => 4 ValueName => WarnOnHTTPSToHTTPRedirect Type => 852 |
FAILURE | 0x00000002 | |
| 09:18:23,367 | 1640 | NtOpenMutant |
Handle => 0x00000394 MutexName => WininetStartupMutex |
SUCCESS | 0x00000000 | |
| 09:18:23,367 | 1640 | RegQueryValueExA |
Handle => 0x00000354 DataLength => 4 ValueName => GlobalUserOffline Type => 852 |
FAILURE | 0x00000002 | |
| 09:18:23,367 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000374 FileInformation => \x00\xc0\x03\x00\x00\x00\x00\x00\x00\xc0\x03\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:18:23,367 | 1640 | NtOpenMutant |
Handle => 0x000003a0 MutexName => WininetConnectionMutex |
SUCCESS | 0x00000000 | |
| 09:18:23,367 | 1640 | NtCreateMutant |
Handle => 0x000003a4 InitialOwner => 0 MutexName => |
SUCCESS | 0x00000000 | |
| 09:18:23,367 | 1640 | NtOpenMutant |
Handle => 0x000003a8 MutexName => WininetProxyRegistryMutex |
SUCCESS | 0x00000000 | |
| 09:18:23,367 | 1640 | RegQueryValueExA |
Handle => 0x00000354 DataLength => 4 ValueName => EnableAutodial Type => 852 |
FAILURE | 0x00000002 | |
| 09:18:23,367 | 1640 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => rnaapp.exe |
FAILURE | 3221225781 | 1 time |
| 09:18:23,367 | 1640 | RegOpenKeyExA |
Handle => 0x000003ac Registry => 0x80000002 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:18:23,367 | 1640 | RegQueryValueExA |
Handle => 0x000003ac DataLength => 11 ValueName => UrlEncoding Type => 1 |
FAILURE | 0x000000ea | |
| 09:18:23,367 | 1640 | RegCloseKey |
Handle => 0x000003ac |
SUCCESS | 0x00000000 | |
| 09:18:23,367 | 1640 | RegQueryValueExA |
Handle => 0x00000354 DataLength => 4 ValueName => TruncateFileName Type => 852 |
FAILURE | 0x00000002 | |
| 09:18:23,367 | 1640 | RegQueryValueExA |
Handle => 0x00000354 DataLength => 4 ValueName => BadProxyExpiresTime Type => 852 |
FAILURE | 0x00000002 | |
| 09:18:23,477 | 1640 | LdrLoadDll |
Flags => 33290860 BaseAddress => 0x71ad0000 FileName => wsock32 |
SUCCESS | 0x00000000 | |
| 09:18:23,477 | 1640 | LdrGetProcedureAddress |
Ordinal => 1 FunctionName => FunctionAddress => 0x71ac1040 ModuleHandle => 0x71ad0000 |
SUCCESS | 0x00000000 | |
| 09:18:23,477 | 1640 | LdrGetProcedureAddress |
Ordinal => 2 FunctionName => FunctionAddress => 0x71ab4480 ModuleHandle => 0x71ad0000 |
SUCCESS | 0x00000000 | |
| 09:18:23,477 | 1640 | LdrGetProcedureAddress |
Ordinal => 3 FunctionName => FunctionAddress => 0x71ab3e2b ModuleHandle => 0x71ad0000 |
SUCCESS | 0x00000000 | |
| 09:18:23,477 | 1640 | LdrGetProcedureAddress |
Ordinal => 4 FunctionName => FunctionAddress => 0x71ab4a07 ModuleHandle => 0x71ad0000 |
SUCCESS | 0x00000000 | |
| 09:18:23,477 | 1640 | LdrGetProcedureAddress |
Ordinal => 5 FunctionName => FunctionAddress => 0x71ac0b68 ModuleHandle => 0x71ad0000 |
SUCCESS | 0x00000000 | |
| 09:18:23,477 | 1640 | LdrGetProcedureAddress |
Ordinal => 6 FunctionName => FunctionAddress => 0x71ab3d10 ModuleHandle => 0x71ad0000 |
SUCCESS | 0x00000000 | |
| 09:18:23,477 | 1640 | LdrGetProcedureAddress |
Ordinal => 7 FunctionName => FunctionAddress => 0x71ad2ed6 ModuleHandle => 0x71ad0000 |
SUCCESS | 0x00000000 | |
| 09:18:23,477 | 1640 | LdrGetProcedureAddress |
Ordinal => 8 FunctionName => FunctionAddress => 0x71ab2ead ModuleHandle => 0x71ad0000 |
SUCCESS | 0x00000000 | |
| 09:18:23,477 | 1640 | LdrGetProcedureAddress |
Ordinal => 9 FunctionName => FunctionAddress => 0x71ab2e53 ModuleHandle => 0x71ad0000 |
SUCCESS | 0x00000000 | |
| 09:18:23,477 | 1640 | LdrGetProcedureAddress |
Ordinal => 10 FunctionName => FunctionAddress => 0x71ab2ee1 ModuleHandle => 0x71ad0000 |
SUCCESS | 0x00000000 | |
| 09:18:23,477 | 1640 | LdrGetProcedureAddress |
Ordinal => 11 FunctionName => FunctionAddress => 0x71ab45c1 ModuleHandle => 0x71ad0000 |
SUCCESS | 0x00000000 | |
| 09:18:23,477 | 1640 | LdrGetProcedureAddress |
Ordinal => 12 FunctionName => FunctionAddress => 0x71ab3f50 ModuleHandle => 0x71ad0000 |
SUCCESS | 0x00000000 | |
| 09:18:23,477 | 1640 | LdrGetProcedureAddress |
Ordinal => 13 FunctionName => FunctionAddress => 0x71ab8cd3 ModuleHandle => 0x71ad0000 |
SUCCESS | 0x00000000 | |
| 09:18:23,477 | 1640 | LdrGetProcedureAddress |
Ordinal => 15 FunctionName => FunctionAddress => 0x71ab2e53 ModuleHandle => 0x71ad0000 |
SUCCESS | 0x00000000 | |
| 09:18:23,477 | 1640 | LdrGetProcedureAddress |
Ordinal => 16 FunctionName => FunctionAddress => 0x71ad2e70 ModuleHandle => 0x71ad0000 |
SUCCESS | 0x00000000 | |
| 09:18:23,477 | 1640 | LdrGetProcedureAddress |
Ordinal => 17 FunctionName => FunctionAddress => 0x71ad3001 ModuleHandle => 0x71ad0000 |
SUCCESS | 0x00000000 | |
| 09:18:23,477 | 1640 | LdrGetProcedureAddress |
Ordinal => 18 FunctionName => FunctionAddress => 0x71ab30a8 ModuleHandle => 0x71ad0000 |
SUCCESS | 0x00000000 | |
| 09:18:23,508 | 1640 | LdrGetProcedureAddress |
Ordinal => 19 FunctionName => FunctionAddress => 0x71ab4c27 ModuleHandle => 0x71ad0000 |
SUCCESS | 0x00000000 | |
| 09:18:23,508 | 1640 | LdrGetProcedureAddress |
Ordinal => 20 FunctionName => FunctionAddress => 0x71ab2f51 ModuleHandle => 0x71ad0000 |
SUCCESS | 0x00000000 | |
| 09:18:23,508 | 1640 | LdrGetProcedureAddress |
Ordinal => 21 FunctionName => FunctionAddress => 0x71ad2e30 ModuleHandle => 0x71ad0000 |
SUCCESS | 0x00000000 | |
| 09:18:23,508 | 1640 | LdrGetProcedureAddress |
Ordinal => 22 FunctionName => FunctionAddress => 0x71ac0bf6 ModuleHandle => 0x71ad0000 |
SUCCESS | 0x00000000 | |
| 09:18:23,508 | 1640 | LdrGetProcedureAddress |
Ordinal => 23 FunctionName => FunctionAddress => 0x71ab4211 ModuleHandle => 0x71ad0000 |
SUCCESS | 0x00000000 | |
| 09:18:23,508 | 1640 | LdrGetProcedureAddress |
Ordinal => 52 FunctionName => FunctionAddress => 0x71ab5355 ModuleHandle => 0x71ad0000 |
SUCCESS | 0x00000000 | |
| 09:18:23,508 | 1640 | LdrGetProcedureAddress |
Ordinal => 57 FunctionName => FunctionAddress => 0x71ab5449 ModuleHandle => 0x71ad0000 |
SUCCESS | 0x00000000 | |
| 09:18:23,508 | 1640 | LdrGetProcedureAddress |
Ordinal => 111 FunctionName => FunctionAddress => 0x71ab3cce ModuleHandle => 0x71ad0000 |
SUCCESS | 0x00000000 | |
| 09:18:23,508 | 1640 | LdrGetProcedureAddress |
Ordinal => 112 FunctionName => FunctionAddress => 0x71ab2a5e ModuleHandle => 0x71ad0000 |
SUCCESS | 0x00000000 | |
| 09:18:23,508 | 1640 | LdrGetProcedureAddress |
Ordinal => 115 FunctionName => FunctionAddress => 0x71ab6a55 ModuleHandle => 0x71ad0000 |
SUCCESS | 0x00000000 | |
| 09:18:23,508 | 1640 | LdrGetProcedureAddress |
Ordinal => 116 FunctionName => FunctionAddress => 0x71ab3fed ModuleHandle => 0x71ad0000 |
SUCCESS | 0x00000000 | |
| 09:18:23,508 | 1640 | LdrGetProcedureAddress |
Ordinal => 151 FunctionName => FunctionAddress => 0x71ab3f7b ModuleHandle => 0x71ad0000 |
SUCCESS | 0x00000000 | |
| 09:18:23,508 | 1640 | WSAStartup |
VersionRequested => 0x00000101 |
SUCCESS | 0x00000000 | |
| 09:18:23,508 | 1640 | LdrLoadDll |
Flags => 33290860 BaseAddress => 0x71ab0000 FileName => ws2_32 |
SUCCESS | 0x00000000 | |
| 09:18:23,508 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => WSALookupServiceBeginW FunctionAddress => 0x71ab35ef ModuleHandle => 0x71ab0000 |
SUCCESS | 0x00000000 | |
| 09:18:23,508 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => WSALookupServiceEnd FunctionAddress => 0x71ab350e ModuleHandle => 0x71ab0000 |
SUCCESS | 0x00000000 | |
| 09:18:23,508 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => WSALookupServiceNextW FunctionAddress => 0x71ab3181 ModuleHandle => 0x71ab0000 |
SUCCESS | 0x00000000 | |
| 09:18:23,508 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => WSANSPIoctl FunctionAddress => 0x71ab5086 ModuleHandle => 0x71ab0000 |
SUCCESS | 0x00000000 | |
| 09:18:23,518 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => getaddrinfo FunctionAddress => 0x71ab2a6f ModuleHandle => 0x71ab0000 |
SUCCESS | 0x00000000 | |
| 09:18:23,518 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => freeaddrinfo FunctionAddress => 0x71ab2b0b ModuleHandle => 0x71ab0000 |
SUCCESS | 0x00000000 | |
| 09:18:23,518 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => getnameinfo FunctionAddress => 0x71abc689 ModuleHandle => 0x71ab0000 |
SUCCESS | 0x00000000 | |
| 09:18:23,518 | 1640 | CreateThread |
ThreadId => 520 StartRoutine => 0x771d922e Parameter => 0x001fc528 CreationFlags => 0 |
SUCCESS | 0x000003b4 | |
| 09:18:23,518 | 1640 | NtCreateSection |
ObjectAttributes => DesiredAccess => 0x000f0007 SectionHandle => 0x000003b8 FileHandle => 0x00000000 |
SUCCESS | 0x00000000 | |
| 09:18:23,518 | 1640 | ZwMapViewOfSection |
SectionOffset => 0x01fbfcb0 SectionHandle => 0x000003b8 ProcessHandle => 0xffffffff BaseAddress => 0x02160000 |
SUCCESS | 0x00000000 | |
| 09:18:23,518 | 520 | socket |
type => 2 protocol => 17 af => 2 |
SUCCESS | 0x000003d0 | |
| 09:18:23,518 | 520 | bind |
ip => 127.0.0.1 socket => 0x000003d0 port => 0 |
SUCCESS | 0x00000000 | |
| 09:18:23,518 | 520 | NtDeviceIoControlFile |
InputBuffer => FileHandle => 0x000003d0 OutputBuffer => \x01\x00\x00\x00\x01\x00\x00\x00\x0e\x00\x02\x00\x04\x0f\x7f\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:18:23,518 | 520 | connect |
socket => 0x000003d0 |
SUCCESS | 0x00000000 | |
| 09:18:23,568 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => InternetSetStatusCallbackA FunctionAddress => 0x771d9064 ModuleHandle => 0x771b0000 |
SUCCESS | 0x00000000 | |
| 09:18:23,588 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => InternetConnectA FunctionAddress => 0x771c3452 ModuleHandle => 0x771b0000 |
SUCCESS | 0x00000000 | |
| 09:18:23,588 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000374 FileInformation => \x00\xc0\x03\x00\x00\x00\x00\x00\x00\xc0\x03\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:18:23,588 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => InternetQueryOptionW FunctionAddress => 0x771d5a5f ModuleHandle => 0x771b0000 |
SUCCESS | 0x00000000 | |
| 09:18:23,588 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x002434b8 | |
| 09:18:23,588 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x002434b8 | |
| 09:18:23,588 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x002434b8 | |
| 09:18:23,588 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x002434b8 | |
| 09:18:23,588 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x002434b8 | |
| 09:18:23,588 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x002434b8 | |
| 09:18:23,588 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x002434b8 | |
| 09:18:23,588 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x002434b8 | |
| 09:18:23,588 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x000003c4 |
SUCCESS | 0x00000000 | |
| 09:18:23,598 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x000003d8 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:23,638 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\A9R40C6.tmp |
SUCCESS | 4294967295 | |
| 09:18:23,638 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x002434b8 | |
| 09:18:23,648 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x002434b8 | |
| 09:18:23,648 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x002434b8 | |
| 09:18:23,648 | 1640 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x002434b8 | |
| 09:18:23,648 | 1640 | NtCreateFile |
ShareAccess => 0 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\A9R40C6.tmp DesiredAccess => 0x0012019f CreateDisposition => 5 FileHandle => 0x000003c4 |
SUCCESS | 0x00000000 | |
| 09:18:23,648 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x000003d8 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:23,648 | 1640 | NtQueryInformationFile |
FileHandle => 0x000003c4 FileInformation => p\xe6\x89\xc0\x8a\xa2\xcf\x01p\xe6\x89\xc0\x8a\xa2\xcf\x01p\xe6\x89\xc0\x8a\xa2\xcf\x01p\xe6\x89\xc0\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00ZL\x00\x00\x00\x00\x03\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x90\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:23,658 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => HttpOpenRequestA FunctionAddress => 0x771c2af9 ModuleHandle => 0x771b0000 |
SUCCESS | 0x00000000 | |
| 09:18:23,658 | 1640 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000001 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Http Filters\RPA |
FAILURE | 0x00000002 | |
| 09:18:23,658 | 1640 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000002 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Http Filters\RPA |
FAILURE | 0x00000002 | |
| 09:18:23,658 | 1640 | RegOpenKeyExW |
Handle => 0x000003c4 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:18:23,658 | 1640 | RegQueryValueExW |
Handle => 0x000003c4 DataLength => 4 ValueName => Security_HKLM_only Type => 33290628 |
FAILURE | 0x00000002 | |
| 09:18:23,658 | 1640 | RegCloseKey |
Handle => 0x000003c4 |
SUCCESS | 0x00000000 | |
| 09:18:23,658 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:18:23,658 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:18:23,658 | 1640 | RegOpenKeyExW |
Handle => 0x000003c4 Registry => 0x80000002 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
SUCCESS | 0x00000000 | |
| 09:18:23,658 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:18:23,668 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x000003c4 SubKey => FEATURE_INCLUDE_PORT_IN_SPN_KB908209 |
FAILURE | 0x00000002 | |
| 09:18:23,668 | 1640 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | 1 time |
| 09:18:23,668 | 1640 | RegCloseKey |
Handle => 0x000003c4 |
SUCCESS | 0x00000000 | |
| 09:18:23,668 | 1640 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | |
| 09:18:23,668 | 1640 | RegOpenKeyExW |
Handle => 0x000003c4 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:18:23,668 | 1640 | RegQueryValueExW |
Handle => 0x000003c4 DataLength => 4 ValueName => Security_HKLM_only Type => 33290624 |
FAILURE | 0x00000002 | |
| 09:18:23,668 | 1640 | RegCloseKey |
Handle => 0x000003c4 |
SUCCESS | 0x00000000 | |
| 09:18:23,668 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:18:23,668 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:18:23,668 | 1640 | RegOpenKeyExW |
Handle => 0x000003c4 Registry => 0x80000002 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
SUCCESS | 0x00000000 | |
| 09:18:23,668 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:18:23,668 | 1640 | RegOpenKeyExW |
Handle => 0x000003d8 Registry => 0x000003c4 SubKey => FEATURE_MIME_HANDLING |
SUCCESS | 0x00000000 | |
| 09:18:23,668 | 1640 | RegQueryValueExW |
Handle => 0x000003d8 DataLength => 4 ValueName => AcroRd32.exe Type => 33290596 |
FAILURE | 0x00000002 | |
| 09:18:23,668 | 1640 | RegQueryValueExW |
Handle => 0x000003d8 DataLength => 4 ValueName => * Type => 33290596 |
FAILURE | 0x00000002 | |
| 09:18:23,668 | 1640 | RegCloseKey |
Handle => 0x000003d8 |
SUCCESS | 0x00000000 | |
| 09:18:23,668 | 1640 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | 1 time |
| 09:18:23,668 | 1640 | RegCloseKey |
Handle => 0x000003c4 |
SUCCESS | 0x00000000 | |
| 09:18:23,668 | 1640 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | |
| 09:18:23,668 | 1640 | RegOpenKeyExW |
Handle => 0x000003c4 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:18:23,668 | 1640 | RegQueryValueExW |
Handle => 0x000003c4 DataLength => 4 ValueName => Security_HKLM_only Type => 33290328 |
FAILURE | 0x00000002 | |
| 09:18:23,668 | 1640 | RegCloseKey |
Handle => 0x000003c4 |
SUCCESS | 0x00000000 | |
| 09:18:23,668 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:18:23,668 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:18:23,668 | 1640 | RegOpenKeyExW |
Handle => 0x000003c4 Registry => 0x80000002 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
SUCCESS | 0x00000000 | |
| 09:18:23,668 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:18:23,668 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x000003c4 SubKey => FEATURE_HTTP_USERNAME_PASSWORD_DISABLE |
FAILURE | 0x00000002 | |
| 09:18:23,678 | 1640 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | 1 time |
| 09:18:23,678 | 1640 | RegCloseKey |
Handle => 0x000003c4 |
SUCCESS | 0x00000000 | |
| 09:18:23,678 | 1640 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | |
| 09:18:23,678 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => HttpAddRequestHeadersA FunctionAddress => 0x771c40ca ModuleHandle => 0x771b0000 |
SUCCESS | 0x00000000 | |
| 09:18:23,678 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => HttpSendRequestA FunctionAddress => 0x771c60a1 ModuleHandle => 0x771b0000 |
SUCCESS | 0x00000000 | |
| 09:18:23,678 | 1640 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => KERNEL32.DLL |
SUCCESS | 0x00000000 | |
| 09:18:23,678 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => QueueUserWorkItem FunctionAddress => 0x7c830a52 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:18:23,688 | 1640 | LdrLoadDll |
Flags => 33291756 BaseAddress => 0x76ee0000 FileName => RASAPI32.DLL |
SUCCESS | 0x00000000 | |
| 09:18:23,688 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => RasDialW FunctionAddress => 0x76ef68db ModuleHandle => 0x76ee0000 |
SUCCESS | 0x00000000 | |
| 09:18:23,698 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => RasHangUpW FunctionAddress => 0x76ee8bcd ModuleHandle => 0x76ee0000 |
SUCCESS | 0x00000000 | |
| 09:18:23,698 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => RasEnumEntriesW FunctionAddress => 0x76ee3ce9 ModuleHandle => 0x76ee0000 |
SUCCESS | 0x00000000 | |
| 09:18:23,698 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => RasGetEntryDialParamsW FunctionAddress => 0x76ee7ad0 ModuleHandle => 0x76ee0000 |
SUCCESS | 0x00000000 | |
| 09:18:23,698 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => RasSetEntryDialParamsW FunctionAddress => 0x76ee917c ModuleHandle => 0x76ee0000 |
SUCCESS | 0x00000000 | |
| 09:18:23,698 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => RasEditPhonebookEntryW FunctionAddress => 0x76ee6839 ModuleHandle => 0x76ee0000 |
SUCCESS | 0x00000000 | |
| 09:18:23,698 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => RasCreatePhonebookEntryW FunctionAddress => 0x76ee6767 ModuleHandle => 0x76ee0000 |
SUCCESS | 0x00000000 | |
| 09:18:23,698 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => RasGetErrorStringW FunctionAddress => 0x76ee7d38 ModuleHandle => 0x76ee0000 |
SUCCESS | 0x00000000 | |
| 09:18:23,698 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => RasGetConnectStatusW FunctionAddress => 0x76ee70cb ModuleHandle => 0x76ee0000 |
SUCCESS | 0x00000000 | |
| 09:18:23,698 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => RasEnumConnectionsW FunctionAddress => 0x76ee2520 ModuleHandle => 0x76ee0000 |
SUCCESS | 0x00000000 | |
| 09:18:23,698 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => RasGetEntryPropertiesW FunctionAddress => 0x76ee9a5b ModuleHandle => 0x76ee0000 |
SUCCESS | 0x00000000 | |
| 09:18:23,698 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => RasGetCredentialsW FunctionAddress => 0x76eeacb1 ModuleHandle => 0x76ee0000 |
SUCCESS | 0x00000000 | |
| 09:18:23,698 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => RasSetCredentialsW FunctionAddress => 0x76eeb078 ModuleHandle => 0x76ee0000 |
SUCCESS | 0x00000000 | |
| 09:18:23,698 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => RasGetAutodialAddressA FunctionAddress => 0x76eebbe0 ModuleHandle => 0x76ee0000 |
SUCCESS | 0x00000000 | |
| 09:18:23,698 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => RasSetAutodialAddressA FunctionAddress => 0x76eec044 ModuleHandle => 0x76ee0000 |
SUCCESS | 0x00000000 | |
| 09:18:23,698 | 1640 | LdrLoadDll |
Flags => 33291604 BaseAddress => 0x76e80000 FileName => RTUTILS.DLL |
SUCCESS | 0x00000000 | |
| 09:18:23,698 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => TraceRegisterExA FunctionAddress => 0x76e8212f ModuleHandle => 0x76e80000 |
SUCCESS | 0x00000000 | |
| 09:18:23,698 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => TraceDeregisterA FunctionAddress => 0x76e83ff9 ModuleHandle => 0x76e80000 |
SUCCESS | 0x00000000 | |
| 09:18:23,698 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => TraceDeregisterExA FunctionAddress => 0x76e82d77 ModuleHandle => 0x76e80000 |
SUCCESS | 0x00000000 | |
| 09:18:23,698 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => TracePrintfA FunctionAddress => 0x76e81aad ModuleHandle => 0x76e80000 |
SUCCESS | 0x00000000 | |
| 09:18:23,698 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => TracePrintfExA FunctionAddress => 0x76e819e2 ModuleHandle => 0x76e80000 |
SUCCESS | 0x00000000 | |
| 09:18:23,698 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => TraceDumpExA FunctionAddress => 0x76e8253f ModuleHandle => 0x76e80000 |
SUCCESS | 0x00000000 | |
| 09:18:23,698 | 1640 | RegCreateKeyExA |
Handle => 0x00000410 Access => 983103 Registry => 0x80000002 Class => SubKey => Software\Microsoft\Tracing |
SUCCESS | 0x00000000 | |
| 09:18:23,698 | 1640 | RegQueryValueExA |
Handle => 0x00000410 Data => 0 ValueName => EnableConsoleTracing |
SUCCESS | 0x00000000 | |
| 09:18:23,698 | 1640 | RegCloseKey |
Handle => 0x00000410 |
SUCCESS | 0x00000000 | |
| 09:18:23,698 | 1640 | RegOpenKeyExA |
Handle => 0x00000418 Registry => 0x80000002 SubKey => Software\Microsoft\Tracing\RASAPI32 |
SUCCESS | 0x00000000 | |
| 09:18:23,698 | 1640 | RegQueryValueExA |
Handle => 0x00000418 Data => 0 ValueName => EnableFileTracing |
SUCCESS | 0x00000000 | |
| 09:18:23,698 | 1640 | RegQueryValueExA |
Handle => 0x00000418 Data => 4294901760 ValueName => FileTracingMask |
SUCCESS | 0x00000000 | |
| 09:18:23,698 | 1640 | RegQueryValueExA |
Handle => 0x00000418 Data => 0 ValueName => EnableConsoleTracing |
SUCCESS | 0x00000000 | |
| 09:18:23,698 | 1640 | RegQueryValueExA |
Handle => 0x00000418 Data => 4294901760 ValueName => ConsoleTracingMask |
SUCCESS | 0x00000000 | |
| 09:18:23,698 | 1640 | RegQueryValueExA |
Handle => 0x00000418 Data => 1048576 ValueName => MaxFileSize |
SUCCESS | 0x00000000 | |
| 09:18:23,698 | 1640 | RegQueryValueExA |
Handle => 0x00000418 Data => %windir%\tracing\x00 ValueName => FileDirectory |
SUCCESS | 0x00000000 | |
| 09:18:23,698 | 1640 | RegQueryValueExA |
Handle => 0x00000418 Data => 0 ValueName => EnableFileTracing |
SUCCESS | 0x00000000 | |
| 09:18:23,698 | 1640 | RegQueryValueExA |
Handle => 0x00000418 Data => 4294901760 ValueName => FileTracingMask |
SUCCESS | 0x00000000 | |
| 09:18:23,698 | 1640 | RegQueryValueExA |
Handle => 0x00000418 Data => 0 ValueName => EnableConsoleTracing |
SUCCESS | 0x00000000 | |
| 09:18:23,698 | 1640 | RegQueryValueExA |
Handle => 0x00000418 Data => 4294901760 ValueName => ConsoleTracingMask |
SUCCESS | 0x00000000 | |
| 09:18:23,698 | 1640 | RegQueryValueExA |
Handle => 0x00000418 Data => 1048576 ValueName => MaxFileSize |
SUCCESS | 0x00000000 | |
| 09:18:23,698 | 1640 | RegQueryValueExA |
Handle => 0x00000418 Data => %windir%\tracing\x00 ValueName => FileDirectory |
SUCCESS | 0x00000000 | |
| 09:18:23,698 | 1640 | OpenSCManagerW |
MachineName => DatabaseName => DesiredAccess => 2147483648 |
SUCCESS | 0x0025f4d8 | |
| 09:18:23,698 | 1640 | OpenServiceW |
ServiceControlManager => 0x0025f4d8 ServiceName => RASMAN DesiredAccess => 4 |
SUCCESS | 0x0025f460 | |
| 09:18:23,698 | 1640 | RegQueryValueExA |
Handle => 0x00000354 DataLength => 4 ValueName => EnableAutodial Type => 852 |
FAILURE | 0x00000002 | |
| 09:18:23,698 | 1640 | OpenSCManagerA |
MachineName => DatabaseName => DesiredAccess => 2147483648 |
SUCCESS | 0x0025f500 | |
| 09:18:23,718 | 1640 | LdrLoadDll |
Flags => 33291760 BaseAddress => 0x722b0000 FileName => sensapi.dll |
SUCCESS | 0x00000000 | |
| 09:18:23,718 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => IsNetworkAlive FunctionAddress => 0x722b1260 ModuleHandle => 0x722b0000 |
SUCCESS | 0x00000000 | |
| 09:18:23,718 | 1640 | NtOpenSection |
DesiredAccess => 0x00000004 ObjectAttributes => C:\SENS Information Cache SectionHandle => 0x0000042c |
SUCCESS | 0x00000000 | |
| 09:18:23,718 | 1640 | ZwMapViewOfSection |
SectionOffset => 0x01fbfdc8 SectionHandle => 0x0000042c ProcessHandle => 0xffffffff BaseAddress => 0x029e0000 |
SUCCESS | 0x00000000 | |
| 09:18:23,718 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => PIPE\lsarpc DesiredAccess => 0xc0100080 CreateDisposition => 1 FileHandle => 0x00000434 |
SUCCESS | 0x00000000 | |
| 09:18:23,728 | 1640 | NtSetInformationFile |
FileHandle => 0x00000434 FileInformation => |
SUCCESS | 0x00000000 | 1 time |
| 09:18:23,728 | 1640 | NtWriteFile |
Buffer => \x05\x00\x0b\x03\x10\x00\x00\x00H\x00\x00\x00\x01\x00\x00\x00\xb8\x10\xb8\x10\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x01\x00xW4\x124\x12\xcd\xab\xef\x00\x01#Eg\x89\xab\x00\x00\x00\x00\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x00\x00 FileHandle => 0x00000434 |
SUCCESS | 0x00000000 | |
| 09:18:23,728 | 1640 | NtReadFile |
Buffer => \x05\x00\x0c\x03\x10\x00\x00\x00D\x00\x00\x00\x01\x00\x00\x00\xb8\x10\xb8\x10\xa7E\x00\x00\x0c\x00\PIPE\lsass\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x00\x00 FileHandle => 0x00000434 |
SUCCESS | 0x00000000 | |
| 09:18:23,728 | 420 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002434f0 | |
| 09:18:23,728 | 420 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002434f0 | |
| 09:18:23,728 | 420 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002434f0 | |
| 09:18:23,728 | 420 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002434f0 | |
| 09:18:23,728 | 420 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000043c |
SUCCESS | 0x00000000 | |
| 09:18:23,728 | 420 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000448 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:23,728 | 420 | NtQueryInformationFile |
FileHandle => 0x0000043c FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01P\xd5O\xc0\x8a\xa2\xcf\x01@\x06?\xc0\x8a\xa2\xcf\x01@\x06?\xc0\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:23,738 | 420 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002434f0 | |
| 09:18:23,738 | 420 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002434f0 | |
| 09:18:23,738 | 420 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002434f0 | |
| 09:18:23,738 | 420 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002434f0 | |
| 09:18:23,738 | 420 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000043c |
SUCCESS | 0x00000000 | |
| 09:18:23,738 | 420 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000448 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:23,738 | 420 | NtQueryInformationFile |
FileHandle => 0x0000043c FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01P\xd5O\xc0\x8a\xa2\xcf\x01@\x06?\xc0\x8a\xa2\xcf\x01@\x06?\xc0\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:23,748 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000374 FileInformation => \x00\xc0\x03\x00\x00\x00\x00\x00\x00\xc0\x03\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:18:23,748 | 1640 | RegOpenKeyExA |
Handle => 0x0000043c Registry => 0x80000002 SubKey => SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:18:23,758 | 1640 | RegQueryValueExA |
Handle => 0x0000043c DataLength => 4 ValueName => ProxySettingsPerUser Type => 1084 |
FAILURE | 0x00000002 | |
| 09:18:23,758 | 1640 | RegCloseKey |
Handle => 0x0000043c |
SUCCESS | 0x00000000 | |
| 09:18:23,758 | 1640 | LdrLoadDll |
Flags => 33290204 BaseAddress => 0x7c900000 FileName => ntdll.dll |
SUCCESS | 0x00000000 | |
| 09:18:23,758 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => RtlConvertSidToUnicodeString FunctionAddress => 0x7c914c35 ModuleHandle => 0x7c900000 |
SUCCESS | 0x00000000 | |
| 09:18:23,758 | 1640 | RegOpenKeyExW |
Handle => 0x0000043c Registry => 0x80000003 SubKey => S-1-5-21-1935655697-1606980848-1060284298-1003 |
SUCCESS | 0x00000000 | |
| 09:18:23,758 | 1640 | RegOpenKeyExA |
Handle => 0x00000448 Registry => 0x0000043c SubKey => Software\Microsoft\windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:18:23,758 | 1640 | RegQueryValueExA |
Handle => 0x00000448 Data => 1 ValueName => MigrateProxy |
SUCCESS | 0x00000000 | |
| 09:18:23,758 | 1640 | RegCloseKey |
Handle => 0x00000448 |
SUCCESS | 0x00000000 | |
| 09:18:23,758 | 1640 | LdrLoadDll |
Flags => 33290128 BaseAddress => 0x7c9c0000 FileName => SHELL32.dll |
SUCCESS | 0x00000000 | |
| 09:18:23,758 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => SHGetFolderPathW FunctionAddress => 0x7c9eed76 ModuleHandle => 0x7c9c0000 |
SUCCESS | 0x00000000 | |
| 09:18:23,758 | 1640 | RegCreateKeyExW |
Handle => 0x0000044c Access => 33554432 Registry => 0x80000002 Class => SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders |
SUCCESS | 0x00000000 | |
| 09:18:23,758 | 1640 | RegQueryValueExW |
Handle => 0x0000044c Data => %\x00A\x00L\x00L\x00U\x00S\x00E\x00R\x00S\x00P\x00R\x00O\x00F\x00I\x00L\x00E\x00%\x00\\x00A\x00p\x00p\x00l\x00i\x00c\x00a\x00t\x00i\x00o\x00n\x00 \x00D\x00a\x00t\x00a\x00\x00\x00 ValueName => Common AppData |
SUCCESS | 0x00000000 | |
| 09:18:23,758 | 1640 | LdrLoadDll |
Flags => 33288796 BaseAddress => 0x769c0000 FileName => USERENV.dll |
SUCCESS | 0x00000000 | |
| 09:18:23,758 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => ExpandEnvironmentStringsForUserW FunctionAddress => 0x769c7733 ModuleHandle => 0x769c0000 |
SUCCESS | 0x00000000 | |
| 09:18:23,768 | 1640 | RegOpenKeyExW |
Handle => 0x00000454 Registry => 0x80000002 SubKey => Software\Microsoft\Windows NT\CurrentVersion\ProfileList |
SUCCESS | 0x00000000 | |
| 09:18:23,768 | 1640 | RegQueryValueExW |
Handle => 0x00000454 Data => %\x00S\x00y\x00s\x00t\x00e\x00m\x00D\x00r\x00i\x00v\x00e\x00%\x00\\x00D\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00s\x00 \x00a\x00n\x00d\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\x00\x00 ValueName => ProfilesDirectory |
SUCCESS | 0x00000000 | |
| 09:18:23,768 | 1640 | RegCloseKey |
Handle => 0x00000454 |
SUCCESS | 0x00000000 | |
| 09:18:23,768 | 1640 | RegOpenKeyExW |
Handle => 0x00000454 Registry => 0x80000002 SubKey => Software\Microsoft\Windows NT\CurrentVersion\ProfileList |
SUCCESS | 0x00000000 | |
| 09:18:23,768 | 1640 | RegQueryValueExW |
Handle => 0x00000454 Data => A\x00l\x00l\x00 \x00U\x00s\x00e\x00r\x00s\x00\x00\x00 ValueName => AllUsersProfile |
SUCCESS | 0x00000000 | |
| 09:18:23,768 | 1640 | RegCloseKey |
Handle => 0x00000454 |
SUCCESS | 0x00000000 | |
| 09:18:23,768 | 1640 | RegOpenKeyExW |
Handle => 0x00000454 Registry => 0x80000002 SubKey => System\CurrentControlSet\Control\Session Manager\Environment |
SUCCESS | 0x00000000 | |
| 09:18:23,768 | 1640 | RegQueryInfoKeyW |
MaxClassLength => 0 MaxValueLength => 124 MaxValueNameLength => 22 ValueCount => 13 MaxSubKeyLength => 0 KeyHandle => 0x00000454 SubKeyCount => 0 Class => |
SUCCESS | 0x00000000 | |
| 09:18:23,768 | 1640 | RegEnumValueW |
Index => 0 Handle => 0x00000454 Data => %\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00\\x00s\x00y\x00s\x00t\x00e\x00m\x003\x002\x00\\x00c\x00m\x00d\x00.\x00e\x00x\x00e\x00\x00\x00 ValueName => ComSpec |
SUCCESS | 0x00000000 | |
| 09:18:23,778 | 1640 | RegEnumValueW |
Index => 1 Handle => 0x00000454 Data => %\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00\\x00s\x00y\x00s\x00t\x00e\x00m\x003\x002\x00;\x00%\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00;\x00%\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00\\x00S\x00y\x00s\x00t\x00e\x00m\x003\x002\x00\\x00W\x00b\x00e\x00m\x00\x00\x00 ValueName => Path |
SUCCESS | 0x00000000 | |
| 09:18:23,778 | 1640 | RegEnumValueW |
Index => 2 Handle => 0x00000454 Data => %\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00\x00\x00 ValueName => windir |
SUCCESS | 0x00000000 | |
| 09:18:23,778 | 1640 | RegEnumValueW |
Index => 3 Handle => 0x00000454 Data => N\x00O\x00\x00\x00 ValueName => FP_NO_HOST_CHECK |
SUCCESS | 0x00000000 | |
| 09:18:23,778 | 1640 | RegEnumValueW |
Index => 4 Handle => 0x00000454 Data => W\x00i\x00n\x00d\x00o\x00w\x00s\x00_\x00N\x00T\x00\x00\x00 ValueName => OS |
SUCCESS | 0x00000000 | |
| 09:18:23,778 | 1640 | RegEnumValueW |
Index => 5 Handle => 0x00000454 Data => x\x008\x006\x00\x00\x00 ValueName => PROCESSOR_ARCHITECTURE |
SUCCESS | 0x00000000 | |
| 09:18:23,778 | 1640 | RegEnumValueW |
Index => 6 Handle => 0x00000454 Data => 1\x005\x00\x00\x00 ValueName => PROCESSOR_LEVEL |
SUCCESS | 0x00000000 | |
| 09:18:23,778 | 1640 | RegEnumValueW |
Index => 7 Handle => 0x00000454 Data => x\x008\x006\x00 \x00F\x00a\x00m\x00i\x00l\x00y\x00 \x001\x005\x00 \x00M\x00o\x00d\x00e\x00l\x00 \x001\x000\x007\x00 \x00S\x00t\x00e\x00p\x00p\x00i\x00n\x00g\x00 \x001\x00,\x00 \x00A\x00u\x00t\x00h\x00e\x00n\x00t\x00i\x00c\x00A\x00M\x00D\x00\x00\x00 ValueName => PROCESSOR_IDENTIFIER |
SUCCESS | 0x00000000 | |
| 09:18:23,778 | 1640 | RegEnumValueW |
Index => 8 Handle => 0x00000454 Data => 6\x00b\x000\x001\x00\x00\x00 ValueName => PROCESSOR_REVISION |
SUCCESS | 0x00000000 | |
| 09:18:23,778 | 1640 | RegEnumValueW |
Index => 9 Handle => 0x00000454 Data => 1\x00\x00\x00 ValueName => NUMBER_OF_PROCESSORS |
SUCCESS | 0x00000000 | |
| 09:18:23,778 | 1640 | RegEnumValueW |
Index => 10 Handle => 0x00000454 Data => .\x00C\x00O\x00M\x00;\x00.\x00E\x00X\x00E\x00;\x00.\x00B\x00A\x00T\x00;\x00.\x00C\x00M\x00D\x00;\x00.\x00V\x00B\x00S\x00;\x00.\x00V\x00B\x00E\x00;\x00.\x00J\x00S\x00;\x00.\x00J\x00S\x00E\x00;\x00.\x00W\x00S\x00F\x00;\x00.\x00W\x00S\x00H\x00\x00\x00 ValueName => PATHEXT |
SUCCESS | 0x00000000 | |
| 09:18:23,778 | 1640 | RegEnumValueW |
Index => 11 Handle => 0x00000454 Data => %\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00\\x00T\x00E\x00M\x00P\x00\x00\x00 ValueName => TEMP |
SUCCESS | 0x00000000 | |
| 09:18:23,778 | 1640 | RegEnumValueW |
Index => 12 Handle => 0x00000454 Data => %\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00\\x00T\x00E\x00M\x00P\x00\x00\x00 ValueName => TMP |
SUCCESS | 0x00000000 | |
| 09:18:23,778 | 1640 | RegEnumValueW |
Index => 0 Handle => 0x00000454 Data => %\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00\\x00s\x00y\x00s\x00t\x00e\x00m\x003\x002\x00\\x00c\x00m\x00d\x00.\x00e\x00x\x00e\x00\x00\x00 ValueName => ComSpec |
SUCCESS | 0x00000000 | |
| 09:18:23,788 | 1640 | RegEnumValueW |
Index => 1 Handle => 0x00000454 Data => %\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00\\x00s\x00y\x00s\x00t\x00e\x00m\x003\x002\x00;\x00%\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00;\x00%\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00\\x00S\x00y\x00s\x00t\x00e\x00m\x003\x002\x00\\x00W\x00b\x00e\x00m\x00\x00\x00 ValueName => Path |
SUCCESS | 0x00000000 | |
| 09:18:23,788 | 1640 | RegEnumValueW |
Index => 2 Handle => 0x00000454 Data => %\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00\x00\x00 ValueName => windir |
SUCCESS | 0x00000000 | |
| 09:18:23,788 | 1640 | RegEnumValueW |
Index => 3 Handle => 0x00000454 Data => N\x00O\x00\x00\x00 ValueName => FP_NO_HOST_CHECK |
SUCCESS | 0x00000000 | |
| 09:18:23,788 | 1640 | RegEnumValueW |
Index => 4 Handle => 0x00000454 Data => W\x00i\x00n\x00d\x00o\x00w\x00s\x00_\x00N\x00T\x00\x00\x00 ValueName => OS |
SUCCESS | 0x00000000 | |
| 09:18:23,788 | 1640 | RegEnumValueW |
Index => 5 Handle => 0x00000454 Data => x\x008\x006\x00\x00\x00 ValueName => PROCESSOR_ARCHITECTURE |
SUCCESS | 0x00000000 | |
| 09:18:23,788 | 1640 | RegEnumValueW |
Index => 6 Handle => 0x00000454 Data => 1\x005\x00\x00\x00 ValueName => PROCESSOR_LEVEL |
SUCCESS | 0x00000000 | |
| 09:18:23,788 | 1640 | RegEnumValueW |
Index => 7 Handle => 0x00000454 Data => x\x008\x006\x00 \x00F\x00a\x00m\x00i\x00l\x00y\x00 \x001\x005\x00 \x00M\x00o\x00d\x00e\x00l\x00 \x001\x000\x007\x00 \x00S\x00t\x00e\x00p\x00p\x00i\x00n\x00g\x00 \x001\x00,\x00 \x00A\x00u\x00t\x00h\x00e\x00n\x00t\x00i\x00c\x00A\x00M\x00D\x00\x00\x00 ValueName => PROCESSOR_IDENTIFIER |
SUCCESS | 0x00000000 | |
| 09:18:23,788 | 1640 | RegEnumValueW |
Index => 8 Handle => 0x00000454 Data => 6\x00b\x000\x001\x00\x00\x00 ValueName => PROCESSOR_REVISION |
SUCCESS | 0x00000000 | |
| 09:18:23,788 | 1640 | RegEnumValueW |
Index => 9 Handle => 0x00000454 Data => 1\x00\x00\x00 ValueName => NUMBER_OF_PROCESSORS |
SUCCESS | 0x00000000 | |
| 09:18:23,788 | 1640 | RegEnumValueW |
Index => 10 Handle => 0x00000454 Data => .\x00C\x00O\x00M\x00;\x00.\x00E\x00X\x00E\x00;\x00.\x00B\x00A\x00T\x00;\x00.\x00C\x00M\x00D\x00;\x00.\x00V\x00B\x00S\x00;\x00.\x00V\x00B\x00E\x00;\x00.\x00J\x00S\x00;\x00.\x00J\x00S\x00E\x00;\x00.\x00W\x00S\x00F\x00;\x00.\x00W\x00S\x00H\x00\x00\x00 ValueName => PATHEXT |
SUCCESS | 0x00000000 | |
| 09:18:23,788 | 1640 | RegEnumValueW |
Index => 11 Handle => 0x00000454 Data => %\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00\\x00T\x00E\x00M\x00P\x00\x00\x00 ValueName => TEMP |
SUCCESS | 0x00000000 | |
| 09:18:23,788 | 1640 | RegEnumValueW |
Index => 12 Handle => 0x00000454 Data => %\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00\\x00T\x00E\x00M\x00P\x00\x00\x00 ValueName => TMP |
SUCCESS | 0x00000000 | |
| 09:18:23,788 | 1640 | RegCloseKey |
Handle => 0x00000454 |
SUCCESS | 0x00000000 | |
| 09:18:23,788 | 1640 | NtOpenKey |
DesiredAccess => 131097 KeyHandle => 0x00000454 ObjectAttributes => \Registry\Machine\System\CurrentControlSet\Control\ComputerName |
SUCCESS | 0x00000000 | |
| 09:18:23,788 | 1640 | NtOpenKey |
DesiredAccess => 131097 KeyHandle => 0x00000458 ObjectAttributes => ActiveComputerName |
SUCCESS | 0x00000000 | |
| 09:18:23,788 | 1640 | NtQueryValueKey |
Information => T\x00U\x00R\x00B\x00O\x00P\x00C\x00\x00\x00 KeyHandle => 0x00000458 ValueName => ComputerName Type => 1 |
SUCCESS | 0x00000000 | |
| 09:18:23,788 | 1640 | RegOpenKeyExW |
Handle => 0x00000454 Registry => 0x80000002 SubKey => Software\Microsoft\Windows NT\CurrentVersion\ProfileList |
SUCCESS | 0x00000000 | |
| 09:18:23,788 | 1640 | RegQueryValueExW |
Handle => 0x00000454 Data => %\x00S\x00y\x00s\x00t\x00e\x00m\x00D\x00r\x00i\x00v\x00e\x00%\x00\\x00D\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00s\x00 \x00a\x00n\x00d\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\x00\x00 ValueName => ProfilesDirectory |
SUCCESS | 0x00000000 | |
| 09:18:23,788 | 1640 | RegCloseKey |
Handle => 0x00000454 |
SUCCESS | 0x00000000 | |
| 09:18:23,788 | 1640 | RegOpenKeyExW |
Handle => 0x00000454 Registry => 0x80000002 SubKey => Software\Microsoft\Windows NT\CurrentVersion\ProfileList |
SUCCESS | 0x00000000 | |
| 09:18:23,788 | 1640 | RegQueryValueExW |
Handle => 0x00000454 Data => D\x00e\x00f\x00a\x00u\x00l\x00t\x00 \x00U\x00s\x00e\x00r\x00\x00\x00 ValueName => DefaultUserProfile |
SUCCESS | 0x00000000 | |
| 09:18:23,788 | 1640 | RegCloseKey |
Handle => 0x00000454 |
SUCCESS | 0x00000000 | |
| 09:18:23,788 | 1640 | RegOpenKeyExW |
Handle => 0x00000454 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion |
SUCCESS | 0x00000000 | |
| 09:18:23,788 | 1640 | RegQueryValueExW |
Handle => 0x00000454 Data => C\x00:\x00\\x00P\x00r\x00o\x00g\x00r\x00a\x00m\x00 \x00F\x00i\x00l\x00e\x00s\x00\x00\x00 ValueName => ProgramFilesDir |
SUCCESS | 0x00000000 | |
| 09:18:23,788 | 1640 | RegQueryValueExW |
Handle => 0x00000454 Data => C\x00:\x00\\x00P\x00r\x00o\x00g\x00r\x00a\x00m\x00 \x00F\x00i\x00l\x00e\x00s\x00\\x00C\x00o\x00m\x00m\x00o\x00n\x00 \x00F\x00i\x00l\x00e\x00s\x00\x00\x00 ValueName => CommonFilesDir |
SUCCESS | 0x00000000 | |
| 09:18:23,798 | 1640 | RegCloseKey |
Handle => 0x00000454 |
SUCCESS | 0x00000000 | |
| 09:18:23,798 | 1640 | RegOpenKeyExW |
Handle => 0x00000454 Registry => 0x80000003 SubKey => S-1-5-21-1935655697-1606980848-1060284298-1003 |
SUCCESS | 0x00000000 | |
| 09:18:23,798 | 1640 | LdrLoadDll |
Flags => 33288196 BaseAddress => 0x5b860000 FileName => netapi32.dll |
SUCCESS | 0x00000000 | |
| 09:18:23,798 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => DsGetDcNameW FunctionAddress => 0x5b86d189 ModuleHandle => 0x5b860000 |
SUCCESS | 0x00000000 | |
| 09:18:23,798 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => DsGetSiteNameW FunctionAddress => 0x5b87299f ModuleHandle => 0x5b860000 |
SUCCESS | 0x00000000 | |
| 09:18:23,798 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => DsRoleGetPrimaryDomainInformation FunctionAddress => 0x5b86cfdd ModuleHandle => 0x5b860000 |
SUCCESS | 0x00000000 | |
| 09:18:23,798 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => DsRoleFreeMemory FunctionAddress => 0x5b86cedd ModuleHandle => 0x5b860000 |
SUCCESS | 0x00000000 | |
| 09:18:23,798 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => NetApiBufferFree FunctionAddress => 0x5b867a00 ModuleHandle => 0x5b860000 |
SUCCESS | 0x00000000 | |
| 09:18:23,798 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => NetUserGetGroups FunctionAddress => 0x5b894df0 ModuleHandle => 0x5b860000 |
SUCCESS | 0x00000000 | |
| 09:18:23,798 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => NetUserGetInfo FunctionAddress => 0x5b86acf1 ModuleHandle => 0x5b860000 |
SUCCESS | 0x00000000 | |
| 09:18:23,798 | 1640 | NtWriteFile |
Buffer => \x05\x00\x0e\x03\x10\x00\x00\x00H\x00\x00\x00
\x00\x00\x00\xb8\x10\xb8\x10\xa7E\x00\x00\x01\x00\x00\x00\x01\x00\x01\x00j(\x199\x0c\xb1\xd0\x11\x9b\xa8\x00\xc0O\xd9.\xf5\x00\x00\x00\x00\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x00\x00 FileHandle => 0x00000434 |
SUCCESS | 0x00000000 | |
| 09:18:23,798 | 1640 | NtReadFile |
Buffer => \x05\x00\x0f\x03\x10\x00\x00\x008\x00\x00\x00
\x00\x00\x00\xb8\x10\xb8\x10\xa7E\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x00\x00 FileHandle => 0x00000434 |
SUCCESS | 0x00000000 | |
| 09:18:23,798 | 1640 | RegOpenKeyExW |
Handle => 0x00000458 Registry => 0x80000002 SubKey => Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1935655697-1606980848-1060284298-1003 |
SUCCESS | 0x00000000 | |
| 09:18:23,798 | 1640 | RegQueryValueExW |
Handle => 0x00000458 Data => %\x00S\x00y\x00s\x00t\x00e\x00m\x00D\x00r\x00i\x00v\x00e\x00%\x00\\x00D\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00s\x00 \x00a\x00n\x00d\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00D\x00W\x00\x00\x00 ValueName => ProfileImagePath |
SUCCESS | 0x00000000 | |
| 09:18:23,798 | 1640 | RegCloseKey |
Handle => 0x00000458 |
SUCCESS | 0x00000000 | |
| 09:18:23,798 | 1640 | RegCreateKeyExW |
Handle => 0x00000458 Access => 131103 Registry => 0x00000454 Class => SubKey => Software\Microsoft\Windows NT\CurrentVersion\Winlogon |
SUCCESS | 0x00000000 | |
| 09:18:23,798 | 1640 | RegQueryValueExW |
Handle => 0x00000458 Data => 1\x00\x00\x00 ValueName => ParseAutoexec |
SUCCESS | 0x00000000 | |
| 09:18:23,808 | 1640 | RegCloseKey |
Handle => 0x00000458 |
SUCCESS | 0x00000000 | |
| 09:18:23,808 | 1640 | NtCreateFile |
ShareAccess => 1 FileName => c:\autoexec.bat DesiredAccess => 0x80100080 CreateDisposition => 1 FileHandle => 0x00000458 |
SUCCESS | 0x00000000 | |
| 09:18:23,808 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000458 FileInformation => \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:18:23,808 | 1640 | NtReadFile |
Buffer => FileHandle => 0x00000458 |
SUCCESS | 0x00000000 | |
| 09:18:23,808 | 1640 | RegOpenKeyExW |
Handle => 0x00000458 Registry => 0x00000454 SubKey => Environment |
SUCCESS | 0x00000000 | |
| 09:18:23,808 | 1640 | RegEnumValueW |
Index => 0 Handle => 0x00000458 Data => %\x00U\x00S\x00E\x00R\x00P\x00R\x00O\x00F\x00I\x00L\x00E\x00%\x00\\x00L\x00o\x00c\x00a\x00l\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00e\x00m\x00p\x00\x00\x00 ValueName => TEMP |
SUCCESS | 0x00000000 | |
| 09:18:23,808 | 1640 | RegEnumValueW |
Index => 1 Handle => 0x00000458 Data => %\x00U\x00S\x00E\x00R\x00P\x00R\x00O\x00F\x00I\x00L\x00E\x00%\x00\\x00L\x00o\x00c\x00a\x00l\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00e\x00m\x00p\x00\x00\x00 ValueName => TMP |
SUCCESS | 0x00000000 | |
| 09:18:23,808 | 1640 | RegEnumValueW |
Index => 2 Handle => 0x00000458 DataLength => 4096 ValueName => TMP Type => 33288356 |
FAILURE | 0x00000103 | |
| 09:18:23,808 | 1640 | RegEnumValueW |
Index => 0 Handle => 0x00000458 Data => %\x00U\x00S\x00E\x00R\x00P\x00R\x00O\x00F\x00I\x00L\x00E\x00%\x00\\x00L\x00o\x00c\x00a\x00l\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00e\x00m\x00p\x00\x00\x00 ValueName => TEMP |
SUCCESS | 0x00000000 | |
| 09:18:23,808 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings |
SUCCESS | 0x002434f0 | |
| 09:18:23,808 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings |
SUCCESS | 0x002434f0 | |
| 09:18:23,808 | 1640 | RegEnumValueW |
Index => 1 Handle => 0x00000458 Data => %\x00U\x00S\x00E\x00R\x00P\x00R\x00O\x00F\x00I\x00L\x00E\x00%\x00\\x00L\x00o\x00c\x00a\x00l\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00e\x00m\x00p\x00\x00\x00 ValueName => TMP |
SUCCESS | 0x00000000 | |
| 09:18:23,808 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings |
SUCCESS | 0x002434f0 | |
| 09:18:23,808 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings |
SUCCESS | 0x002434f0 | |
| 09:18:23,808 | 1640 | RegEnumValueW |
Index => 2 Handle => 0x00000458 DataLength => 4096 ValueName => TMP Type => 33288356 |
FAILURE | 0x00000103 | |
| 09:18:23,808 | 1640 | RegCloseKey |
Handle => 0x00000458 |
SUCCESS | 0x00000000 | |
| 09:18:23,808 | 1640 | RegOpenKeyExW |
Handle => 0x00000458 Registry => 0x00000454 SubKey => Volatile Environment |
SUCCESS | 0x00000000 | |
| 09:18:23,818 | 1640 | RegEnumValueW |
Index => 0 Handle => 0x00000458 Data => \\x00\\x00T\x00U\x00R\x00B\x00O\x00P\x00C\x00\x00\x00 ValueName => LOGONSERVER |
SUCCESS | 0x00000000 | |
| 09:18:23,818 | 1640 | RegEnumValueW |
Index => 1 Handle => 0x00000458 Data => C\x00o\x00n\x00s\x00o\x00l\x00e\x00\x00\x00 ValueName => CLIENTNAME |
SUCCESS | 0x00000000 | |
| 09:18:23,818 | 1640 | RegEnumValueW |
Index => 2 Handle => 0x00000458 Data => C\x00o\x00n\x00s\x00o\x00l\x00e\x00\x00\x00 ValueName => SESSIONNAME |
SUCCESS | 0x00000000 | |
| 09:18:23,818 | 1640 | RegEnumValueW |
Index => 3 Handle => 0x00000458 Data => C\x00:\x00\\x00D\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00s\x00 \x00a\x00n\x00d\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00D\x00W\x00\\x00A\x00p\x00p\x00l\x00i\x00c\x00a\x00t\x00i\x00o\x00n\x00 \x00D\x00a\x00t\x00a\x00\x00\x00 ValueName => APPDATA |
SUCCESS | 0x00000000 | |
| 09:18:23,818 | 1640 | RegEnumValueW |
Index => 4 Handle => 0x00000458 Data => C\x00:\x00\x00\x00 ValueName => HOMEDRIVE |
SUCCESS | 0x00000000 | |
| 09:18:23,818 | 1640 | RegEnumValueW |
Index => 5 Handle => 0x00000458 Data => \x00\x00 ValueName => HOMESHARE |
SUCCESS | 0x00000000 | |
| 09:18:23,818 | 1640 | RegEnumValueW |
Index => 6 Handle => 0x00000458 Data => \\x00D\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00s\x00 \x00a\x00n\x00d\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00D\x00W\x00\x00\x00 ValueName => HOMEPATH |
SUCCESS | 0x00000000 | |
| 09:18:23,818 | 1640 | RegEnumValueW |
Index => 7 Handle => 0x00000458 DataLength => 4096 ValueName => HOMEPATH Type => 33288356 |
FAILURE | 0x00000103 | |
| 09:18:23,818 | 1640 | RegEnumValueW |
Index => 0 Handle => 0x00000458 Data => \\x00\\x00T\x00U\x00R\x00B\x00O\x00P\x00C\x00\x00\x00 ValueName => LOGONSERVER |
SUCCESS | 0x00000000 | |
| 09:18:23,818 | 1640 | RegEnumValueW |
Index => 1 Handle => 0x00000458 Data => C\x00o\x00n\x00s\x00o\x00l\x00e\x00\x00\x00 ValueName => CLIENTNAME |
SUCCESS | 0x00000000 | |
| 09:18:23,818 | 1640 | RegEnumValueW |
Index => 2 Handle => 0x00000458 Data => C\x00o\x00n\x00s\x00o\x00l\x00e\x00\x00\x00 ValueName => SESSIONNAME |
SUCCESS | 0x00000000 | |
| 09:18:23,818 | 1640 | RegEnumValueW |
Index => 3 Handle => 0x00000458 Data => C\x00:\x00\\x00D\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00s\x00 \x00a\x00n\x00d\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00D\x00W\x00\\x00A\x00p\x00p\x00l\x00i\x00c\x00a\x00t\x00i\x00o\x00n\x00 \x00D\x00a\x00t\x00a\x00\x00\x00 ValueName => APPDATA |
SUCCESS | 0x00000000 | |
| 09:18:23,818 | 1640 | RegEnumValueW |
Index => 4 Handle => 0x00000458 Data => C\x00:\x00\x00\x00 ValueName => HOMEDRIVE |
SUCCESS | 0x00000000 | |
| 09:18:23,818 | 1640 | RegEnumValueW |
Index => 5 Handle => 0x00000458 Data => \x00\x00 ValueName => HOMESHARE |
SUCCESS | 0x00000000 | |
| 09:18:23,818 | 1640 | RegEnumValueW |
Index => 6 Handle => 0x00000458 Data => \\x00D\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00s\x00 \x00a\x00n\x00d\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00D\x00W\x00\x00\x00 ValueName => HOMEPATH |
SUCCESS | 0x00000000 | |
| 09:18:23,818 | 1640 | RegEnumValueW |
Index => 7 Handle => 0x00000458 DataLength => 4096 ValueName => HOMEPATH Type => 33288356 |
FAILURE | 0x00000103 | |
| 09:18:23,818 | 1640 | RegCloseKey |
Handle => 0x00000458 |
SUCCESS | 0x00000000 | |
| 09:18:23,818 | 1640 | RegCloseKey |
Handle => 0x00000454 |
SUCCESS | 0x00000000 | |
| 09:18:23,818 | 1640 | NtFreeVirtualMemory |
FreeType => 0x00008000 ProcessHandle => 0xffffffff RegionSize => 0x00001000 BaseAddress => 0x029f0000 |
SUCCESS | 0x00000000 | |
| 09:18:23,818 | 1640 | RegCloseKey |
Handle => 0x0000044c |
SUCCESS | 0x00000000 | |
| 09:18:23,818 | 1640 | RegCreateKeyExW |
Handle => 0x0000044c Access => 33554432 Registry => 0x80000002 Class => SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders |
SUCCESS | 0x00000000 | |
| 09:18:23,818 | 1640 | RegSetValueExW |
Handle => 0x0000044c Buffer => C\x00:\x00\\x00D\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00s\x00 \x00a\x00n\x00d\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00A\x00l\x00l\x00 \x00U\x00s\x00e\x00r\x00s\x00\\x00A\x00p\x00p\x00l\x00i\x00c\x00a\x00t\x00i\x00o\x00n\x00 \x00D\x00a\x00t\x00a\x00\x00\x00 ValueName => Common AppData Type => 1 |
SUCCESS | 0x00000000 | |
| 09:18:23,818 | 1640 | RegCloseKey |
Handle => 0x0000044c |
SUCCESS | 0x00000000 | |
| 09:18:23,818 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Connections\Pbk\*.pbk |
SUCCESS | 4294967295 | |
| 09:18:23,818 | 1640 | FindFirstFileExW |
FileName => C:\WINDOWS\system32\Ras\*.pbk |
SUCCESS | 4294967295 | |
| 09:18:23,818 | 1640 | RegOpenKeyExW |
Handle => 0x0000044c Registry => 0x80000003 SubKey => S-1-5-21-1935655697-1606980848-1060284298-1003 |
SUCCESS | 0x00000000 | |
| 09:18:23,818 | 1640 | RegCreateKeyExW |
Handle => 0x00000454 Access => 33554432 Registry => 0x0000044c Class => SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders |
SUCCESS | 0x00000000 | |
| 09:18:23,818 | 1640 | RegCloseKey |
Handle => 0x0000044c |
SUCCESS | 0x00000000 | |
| 09:18:23,818 | 1640 | RegQueryValueExW |
Handle => 0x00000454 Data => %\x00U\x00S\x00E\x00R\x00P\x00R\x00O\x00F\x00I\x00L\x00E\x00%\x00\\x00A\x00p\x00p\x00l\x00i\x00c\x00a\x00t\x00i\x00o\x00n\x00 \x00D\x00a\x00t\x00a\x00\x00\x00 ValueName => AppData |
SUCCESS | 0x00000000 | |
| 09:18:23,818 | 1640 | RegOpenKeyExW |
Handle => 0x0000044c Registry => 0x80000002 SubKey => Software\Microsoft\Windows NT\CurrentVersion\ProfileList |
SUCCESS | 0x00000000 | |
| 09:18:23,818 | 1640 | RegQueryValueExW |
Handle => 0x0000044c Data => %\x00S\x00y\x00s\x00t\x00e\x00m\x00D\x00r\x00i\x00v\x00e\x00%\x00\\x00D\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00s\x00 \x00a\x00n\x00d\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\x00\x00 ValueName => ProfilesDirectory |
SUCCESS | 0x00000000 | |
| 09:18:23,818 | 1640 | RegCloseKey |
Handle => 0x0000044c |
SUCCESS | 0x00000000 | |
| 09:18:23,818 | 1640 | RegOpenKeyExW |
Handle => 0x0000044c Registry => 0x80000002 SubKey => Software\Microsoft\Windows NT\CurrentVersion\ProfileList |
SUCCESS | 0x00000000 | |
| 09:18:23,818 | 1640 | RegQueryValueExW |
Handle => 0x0000044c Data => A\x00l\x00l\x00 \x00U\x00s\x00e\x00r\x00s\x00\x00\x00 ValueName => AllUsersProfile |
SUCCESS | 0x00000000 | |
| 09:18:23,818 | 1640 | RegCloseKey |
Handle => 0x0000044c |
SUCCESS | 0x00000000 | |
| 09:18:23,818 | 1640 | RegOpenKeyExW |
Handle => 0x0000044c Registry => 0x80000002 SubKey => System\CurrentControlSet\Control\Session Manager\Environment |
SUCCESS | 0x00000000 | |
| 09:18:23,818 | 1640 | RegQueryInfoKeyW |
MaxClassLength => 0 MaxValueLength => 124 MaxValueNameLength => 22 ValueCount => 13 MaxSubKeyLength => 0 KeyHandle => 0x0000044c SubKeyCount => 0 Class => |
SUCCESS | 0x00000000 | |
| 09:18:23,818 | 1640 | RegEnumValueW |
Index => 0 Handle => 0x0000044c Data => %\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00\\x00s\x00y\x00s\x00t\x00e\x00m\x003\x002\x00\\x00c\x00m\x00d\x00.\x00e\x00x\x00e\x00\x00\x00 ValueName => ComSpec |
SUCCESS | 0x00000000 | |
| 09:18:23,818 | 1640 | RegEnumValueW |
Index => 1 Handle => 0x0000044c Data => %\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00\\x00s\x00y\x00s\x00t\x00e\x00m\x003\x002\x00;\x00%\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00;\x00%\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00\\x00S\x00y\x00s\x00t\x00e\x00m\x003\x002\x00\\x00W\x00b\x00e\x00m\x00\x00\x00 ValueName => Path |
SUCCESS | 0x00000000 | |
| 09:18:23,818 | 1640 | RegEnumValueW |
Index => 2 Handle => 0x0000044c Data => %\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00\x00\x00 ValueName => windir |
SUCCESS | 0x00000000 | |
| 09:18:23,818 | 1640 | RegEnumValueW |
Index => 3 Handle => 0x0000044c Data => N\x00O\x00\x00\x00 ValueName => FP_NO_HOST_CHECK |
SUCCESS | 0x00000000 | |
| 09:18:23,818 | 1640 | RegEnumValueW |
Index => 4 Handle => 0x0000044c Data => W\x00i\x00n\x00d\x00o\x00w\x00s\x00_\x00N\x00T\x00\x00\x00 ValueName => OS |
SUCCESS | 0x00000000 | |
| 09:18:23,818 | 1640 | RegEnumValueW |
Index => 5 Handle => 0x0000044c Data => x\x008\x006\x00\x00\x00 ValueName => PROCESSOR_ARCHITECTURE |
SUCCESS | 0x00000000 | |
| 09:18:23,818 | 1640 | RegEnumValueW |
Index => 6 Handle => 0x0000044c Data => 1\x005\x00\x00\x00 ValueName => PROCESSOR_LEVEL |
SUCCESS | 0x00000000 | |
| 09:18:23,818 | 1640 | RegEnumValueW |
Index => 7 Handle => 0x0000044c Data => x\x008\x006\x00 \x00F\x00a\x00m\x00i\x00l\x00y\x00 \x001\x005\x00 \x00M\x00o\x00d\x00e\x00l\x00 \x001\x000\x007\x00 \x00S\x00t\x00e\x00p\x00p\x00i\x00n\x00g\x00 \x001\x00,\x00 \x00A\x00u\x00t\x00h\x00e\x00n\x00t\x00i\x00c\x00A\x00M\x00D\x00\x00\x00 ValueName => PROCESSOR_IDENTIFIER |
SUCCESS | 0x00000000 | |
| 09:18:23,818 | 1640 | RegEnumValueW |
Index => 8 Handle => 0x0000044c Data => 6\x00b\x000\x001\x00\x00\x00 ValueName => PROCESSOR_REVISION |
SUCCESS | 0x00000000 | |
| 09:18:23,818 | 1640 | RegEnumValueW |
Index => 9 Handle => 0x0000044c Data => 1\x00\x00\x00 ValueName => NUMBER_OF_PROCESSORS |
SUCCESS | 0x00000000 | |
| 09:18:23,818 | 1640 | RegEnumValueW |
Index => 10 Handle => 0x0000044c Data => .\x00C\x00O\x00M\x00;\x00.\x00E\x00X\x00E\x00;\x00.\x00B\x00A\x00T\x00;\x00.\x00C\x00M\x00D\x00;\x00.\x00V\x00B\x00S\x00;\x00.\x00V\x00B\x00E\x00;\x00.\x00J\x00S\x00;\x00.\x00J\x00S\x00E\x00;\x00.\x00W\x00S\x00F\x00;\x00.\x00W\x00S\x00H\x00\x00\x00 ValueName => PATHEXT |
SUCCESS | 0x00000000 | |
| 09:18:23,818 | 1640 | RegEnumValueW |
Index => 11 Handle => 0x0000044c Data => %\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00\\x00T\x00E\x00M\x00P\x00\x00\x00 ValueName => TEMP |
SUCCESS | 0x00000000 | |
| 09:18:23,818 | 1640 | RegEnumValueW |
Index => 12 Handle => 0x0000044c Data => %\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00\\x00T\x00E\x00M\x00P\x00\x00\x00 ValueName => TMP |
SUCCESS | 0x00000000 | |
| 09:18:23,818 | 1640 | RegEnumValueW |
Index => 0 Handle => 0x0000044c Data => %\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00\\x00s\x00y\x00s\x00t\x00e\x00m\x003\x002\x00\\x00c\x00m\x00d\x00.\x00e\x00x\x00e\x00\x00\x00 ValueName => ComSpec |
SUCCESS | 0x00000000 | |
| 09:18:23,818 | 1640 | RegEnumValueW |
Index => 1 Handle => 0x0000044c Data => %\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00\\x00s\x00y\x00s\x00t\x00e\x00m\x003\x002\x00;\x00%\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00;\x00%\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00\\x00S\x00y\x00s\x00t\x00e\x00m\x003\x002\x00\\x00W\x00b\x00e\x00m\x00\x00\x00 ValueName => Path |
SUCCESS | 0x00000000 | |
| 09:18:23,818 | 1640 | RegEnumValueW |
Index => 2 Handle => 0x0000044c Data => %\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00\x00\x00 ValueName => windir |
SUCCESS | 0x00000000 | |
| 09:18:23,818 | 1640 | RegEnumValueW |
Index => 3 Handle => 0x0000044c Data => N\x00O\x00\x00\x00 ValueName => FP_NO_HOST_CHECK |
SUCCESS | 0x00000000 | |
| 09:18:23,818 | 1640 | RegEnumValueW |
Index => 4 Handle => 0x0000044c Data => W\x00i\x00n\x00d\x00o\x00w\x00s\x00_\x00N\x00T\x00\x00\x00 ValueName => OS |
SUCCESS | 0x00000000 | |
| 09:18:23,818 | 1640 | RegEnumValueW |
Index => 5 Handle => 0x0000044c Data => x\x008\x006\x00\x00\x00 ValueName => PROCESSOR_ARCHITECTURE |
SUCCESS | 0x00000000 | |
| 09:18:23,818 | 1640 | RegEnumValueW |
Index => 6 Handle => 0x0000044c Data => 1\x005\x00\x00\x00 ValueName => PROCESSOR_LEVEL |
SUCCESS | 0x00000000 | |
| 09:18:23,818 | 1640 | RegEnumValueW |
Index => 7 Handle => 0x0000044c Data => x\x008\x006\x00 \x00F\x00a\x00m\x00i\x00l\x00y\x00 \x001\x005\x00 \x00M\x00o\x00d\x00e\x00l\x00 \x001\x000\x007\x00 \x00S\x00t\x00e\x00p\x00p\x00i\x00n\x00g\x00 \x001\x00,\x00 \x00A\x00u\x00t\x00h\x00e\x00n\x00t\x00i\x00c\x00A\x00M\x00D\x00\x00\x00 ValueName => PROCESSOR_IDENTIFIER |
SUCCESS | 0x00000000 | |
| 09:18:23,818 | 1640 | RegEnumValueW |
Index => 8 Handle => 0x0000044c Data => 6\x00b\x000\x001\x00\x00\x00 ValueName => PROCESSOR_REVISION |
SUCCESS | 0x00000000 | |
| 09:18:23,818 | 1640 | RegEnumValueW |
Index => 9 Handle => 0x0000044c Data => 1\x00\x00\x00 ValueName => NUMBER_OF_PROCESSORS |
SUCCESS | 0x00000000 | |
| 09:18:23,818 | 1640 | RegEnumValueW |
Index => 10 Handle => 0x0000044c Data => .\x00C\x00O\x00M\x00;\x00.\x00E\x00X\x00E\x00;\x00.\x00B\x00A\x00T\x00;\x00.\x00C\x00M\x00D\x00;\x00.\x00V\x00B\x00S\x00;\x00.\x00V\x00B\x00E\x00;\x00.\x00J\x00S\x00;\x00.\x00J\x00S\x00E\x00;\x00.\x00W\x00S\x00F\x00;\x00.\x00W\x00S\x00H\x00\x00\x00 ValueName => PATHEXT |
SUCCESS | 0x00000000 | |
| 09:18:23,818 | 1640 | RegEnumValueW |
Index => 11 Handle => 0x0000044c Data => %\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00\\x00T\x00E\x00M\x00P\x00\x00\x00 ValueName => TEMP |
SUCCESS | 0x00000000 | |
| 09:18:23,818 | 1640 | RegEnumValueW |
Index => 12 Handle => 0x0000044c Data => %\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00\\x00T\x00E\x00M\x00P\x00\x00\x00 ValueName => TMP |
SUCCESS | 0x00000000 | |
| 09:18:23,818 | 1640 | RegCloseKey |
Handle => 0x0000044c |
SUCCESS | 0x00000000 | |
| 09:18:23,818 | 1640 | NtOpenKey |
DesiredAccess => 131097 KeyHandle => 0x0000044c ObjectAttributes => \Registry\Machine\System\CurrentControlSet\Control\ComputerName |
SUCCESS | 0x00000000 | |
| 09:18:23,818 | 1640 | NtOpenKey |
DesiredAccess => 131097 KeyHandle => 0x00000458 ObjectAttributes => ActiveComputerName |
SUCCESS | 0x00000000 | |
| 09:18:23,818 | 1640 | NtQueryValueKey |
Information => T\x00U\x00R\x00B\x00O\x00P\x00C\x00\x00\x00 KeyHandle => 0x00000458 ValueName => ComputerName Type => 1 |
SUCCESS | 0x00000000 | |
| 09:18:23,818 | 1640 | RegOpenKeyExW |
Handle => 0x0000044c Registry => 0x80000002 SubKey => Software\Microsoft\Windows NT\CurrentVersion\ProfileList |
SUCCESS | 0x00000000 | |
| 09:18:23,818 | 1640 | RegQueryValueExW |
Handle => 0x0000044c Data => %\x00S\x00y\x00s\x00t\x00e\x00m\x00D\x00r\x00i\x00v\x00e\x00%\x00\\x00D\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00s\x00 \x00a\x00n\x00d\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\x00\x00 ValueName => ProfilesDirectory |
SUCCESS | 0x00000000 | |
| 09:18:23,818 | 1640 | RegCloseKey |
Handle => 0x0000044c |
SUCCESS | 0x00000000 | |
| 09:18:23,818 | 1640 | RegOpenKeyExW |
Handle => 0x0000044c Registry => 0x80000002 SubKey => Software\Microsoft\Windows NT\CurrentVersion\ProfileList |
SUCCESS | 0x00000000 | |
| 09:18:23,818 | 1640 | RegQueryValueExW |
Handle => 0x0000044c Data => D\x00e\x00f\x00a\x00u\x00l\x00t\x00 \x00U\x00s\x00e\x00r\x00\x00\x00 ValueName => DefaultUserProfile |
SUCCESS | 0x00000000 | |
| 09:18:23,818 | 1640 | RegCloseKey |
Handle => 0x0000044c |
SUCCESS | 0x00000000 | |
| 09:18:23,818 | 1640 | RegOpenKeyExW |
Handle => 0x0000044c Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion |
SUCCESS | 0x00000000 | |
| 09:18:23,818 | 1640 | RegQueryValueExW |
Handle => 0x0000044c Data => C\x00:\x00\\x00P\x00r\x00o\x00g\x00r\x00a\x00m\x00 \x00F\x00i\x00l\x00e\x00s\x00\x00\x00 ValueName => ProgramFilesDir |
SUCCESS | 0x00000000 | |
| 09:18:23,818 | 1640 | RegQueryValueExW |
Handle => 0x0000044c Data => C\x00:\x00\\x00P\x00r\x00o\x00g\x00r\x00a\x00m\x00 \x00F\x00i\x00l\x00e\x00s\x00\\x00C\x00o\x00m\x00m\x00o\x00n\x00 \x00F\x00i\x00l\x00e\x00s\x00\x00\x00 ValueName => CommonFilesDir |
SUCCESS | 0x00000000 | |
| 09:18:23,818 | 1640 | RegCloseKey |
Handle => 0x0000044c |
SUCCESS | 0x00000000 | |
| 09:18:23,818 | 1640 | RegOpenKeyExW |
Handle => 0x0000044c Registry => 0x80000003 SubKey => S-1-5-21-1935655697-1606980848-1060284298-1003 |
SUCCESS | 0x00000000 | |
| 09:18:23,818 | 1640 | RegOpenKeyExW |
Handle => 0x00000458 Registry => 0x80000002 SubKey => Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1935655697-1606980848-1060284298-1003 |
SUCCESS | 0x00000000 | |
| 09:18:23,818 | 1640 | RegQueryValueExW |
Handle => 0x00000458 Data => %\x00S\x00y\x00s\x00t\x00e\x00m\x00D\x00r\x00i\x00v\x00e\x00%\x00\\x00D\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00s\x00 \x00a\x00n\x00d\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00D\x00W\x00\x00\x00 ValueName => ProfileImagePath |
SUCCESS | 0x00000000 | |
| 09:18:23,818 | 1640 | RegCloseKey |
Handle => 0x00000458 |
SUCCESS | 0x00000000 | |
| 09:18:23,828 | 1640 | RegCreateKeyExW |
Handle => 0x00000458 Access => 131103 Registry => 0x0000044c Class => SubKey => Software\Microsoft\Windows NT\CurrentVersion\Winlogon |
SUCCESS | 0x00000000 | |
| 09:18:23,828 | 1640 | RegQueryValueExW |
Handle => 0x00000458 Data => 1\x00\x00\x00 ValueName => ParseAutoexec |
SUCCESS | 0x00000000 | |
| 09:18:23,828 | 1640 | RegCloseKey |
Handle => 0x00000458 |
SUCCESS | 0x00000000 | |
| 09:18:23,828 | 1640 | NtCreateFile |
ShareAccess => 1 FileName => c:\autoexec.bat DesiredAccess => 0x80100080 CreateDisposition => 1 FileHandle => 0x00000458 |
SUCCESS | 0x00000000 | |
| 09:18:23,828 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000458 FileInformation => \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:18:23,828 | 1640 | NtReadFile |
Buffer => FileHandle => 0x00000458 |
SUCCESS | 0x00000000 | |
| 09:18:23,828 | 1640 | RegOpenKeyExW |
Handle => 0x00000458 Registry => 0x0000044c SubKey => Environment |
SUCCESS | 0x00000000 | |
| 09:18:23,828 | 1640 | RegEnumValueW |
Index => 0 Handle => 0x00000458 Data => %\x00U\x00S\x00E\x00R\x00P\x00R\x00O\x00F\x00I\x00L\x00E\x00%\x00\\x00L\x00o\x00c\x00a\x00l\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00e\x00m\x00p\x00\x00\x00 ValueName => TEMP |
SUCCESS | 0x00000000 | |
| 09:18:23,828 | 1640 | RegEnumValueW |
Index => 1 Handle => 0x00000458 Data => %\x00U\x00S\x00E\x00R\x00P\x00R\x00O\x00F\x00I\x00L\x00E\x00%\x00\\x00L\x00o\x00c\x00a\x00l\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00e\x00m\x00p\x00\x00\x00 ValueName => TMP |
SUCCESS | 0x00000000 | |
| 09:18:23,828 | 1640 | RegEnumValueW |
Index => 2 Handle => 0x00000458 DataLength => 4096 ValueName => TMP Type => 33288356 |
FAILURE | 0x00000103 | |
| 09:18:23,828 | 1640 | RegEnumValueW |
Index => 0 Handle => 0x00000458 Data => %\x00U\x00S\x00E\x00R\x00P\x00R\x00O\x00F\x00I\x00L\x00E\x00%\x00\\x00L\x00o\x00c\x00a\x00l\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00e\x00m\x00p\x00\x00\x00 ValueName => TEMP |
SUCCESS | 0x00000000 | |
| 09:18:23,828 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings |
SUCCESS | 0x002434f0 | |
| 09:18:23,828 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings |
SUCCESS | 0x002434f0 | |
| 09:18:23,828 | 1640 | RegEnumValueW |
Index => 1 Handle => 0x00000458 Data => %\x00U\x00S\x00E\x00R\x00P\x00R\x00O\x00F\x00I\x00L\x00E\x00%\x00\\x00L\x00o\x00c\x00a\x00l\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00e\x00m\x00p\x00\x00\x00 ValueName => TMP |
SUCCESS | 0x00000000 | |
| 09:18:23,828 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings |
SUCCESS | 0x002434f0 | |
| 09:18:23,828 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings |
SUCCESS | 0x002434f0 | |
| 09:18:23,828 | 1640 | RegEnumValueW |
Index => 2 Handle => 0x00000458 DataLength => 4096 ValueName => TMP Type => 33288356 |
FAILURE | 0x00000103 | |
| 09:18:23,828 | 1640 | RegCloseKey |
Handle => 0x00000458 |
SUCCESS | 0x00000000 | |
| 09:18:23,828 | 1640 | RegOpenKeyExW |
Handle => 0x00000458 Registry => 0x0000044c SubKey => Volatile Environment |
SUCCESS | 0x00000000 | |
| 09:18:23,828 | 1640 | RegEnumValueW |
Index => 0 Handle => 0x00000458 Data => \\x00\\x00T\x00U\x00R\x00B\x00O\x00P\x00C\x00\x00\x00 ValueName => LOGONSERVER |
SUCCESS | 0x00000000 | |
| 09:18:23,828 | 1640 | RegEnumValueW |
Index => 1 Handle => 0x00000458 Data => C\x00o\x00n\x00s\x00o\x00l\x00e\x00\x00\x00 ValueName => CLIENTNAME |
SUCCESS | 0x00000000 | |
| 09:18:23,828 | 1640 | RegEnumValueW |
Index => 2 Handle => 0x00000458 Data => C\x00o\x00n\x00s\x00o\x00l\x00e\x00\x00\x00 ValueName => SESSIONNAME |
SUCCESS | 0x00000000 | |
| 09:18:23,828 | 1640 | RegEnumValueW |
Index => 3 Handle => 0x00000458 Data => C\x00:\x00\\x00D\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00s\x00 \x00a\x00n\x00d\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00D\x00W\x00\\x00A\x00p\x00p\x00l\x00i\x00c\x00a\x00t\x00i\x00o\x00n\x00 \x00D\x00a\x00t\x00a\x00\x00\x00 ValueName => APPDATA |
SUCCESS | 0x00000000 | |
| 09:18:23,828 | 1640 | RegEnumValueW |
Index => 4 Handle => 0x00000458 Data => C\x00:\x00\x00\x00 ValueName => HOMEDRIVE |
SUCCESS | 0x00000000 | |
| 09:18:23,828 | 1640 | RegEnumValueW |
Index => 5 Handle => 0x00000458 Data => \x00\x00 ValueName => HOMESHARE |
SUCCESS | 0x00000000 | |
| 09:18:23,828 | 1640 | RegEnumValueW |
Index => 6 Handle => 0x00000458 Data => \\x00D\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00s\x00 \x00a\x00n\x00d\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00D\x00W\x00\x00\x00 ValueName => HOMEPATH |
SUCCESS | 0x00000000 | |
| 09:18:23,828 | 1640 | RegEnumValueW |
Index => 7 Handle => 0x00000458 DataLength => 4096 ValueName => HOMEPATH Type => 33288356 |
FAILURE | 0x00000103 | |
| 09:18:23,828 | 1640 | RegEnumValueW |
Index => 0 Handle => 0x00000458 Data => \\x00\\x00T\x00U\x00R\x00B\x00O\x00P\x00C\x00\x00\x00 ValueName => LOGONSERVER |
SUCCESS | 0x00000000 | |
| 09:18:23,828 | 1640 | RegEnumValueW |
Index => 1 Handle => 0x00000458 Data => C\x00o\x00n\x00s\x00o\x00l\x00e\x00\x00\x00 ValueName => CLIENTNAME |
SUCCESS | 0x00000000 | |
| 09:18:23,828 | 1640 | RegEnumValueW |
Index => 2 Handle => 0x00000458 Data => C\x00o\x00n\x00s\x00o\x00l\x00e\x00\x00\x00 ValueName => SESSIONNAME |
SUCCESS | 0x00000000 | |
| 09:18:23,828 | 1640 | RegEnumValueW |
Index => 3 Handle => 0x00000458 Data => C\x00:\x00\\x00D\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00s\x00 \x00a\x00n\x00d\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00D\x00W\x00\\x00A\x00p\x00p\x00l\x00i\x00c\x00a\x00t\x00i\x00o\x00n\x00 \x00D\x00a\x00t\x00a\x00\x00\x00 ValueName => APPDATA |
SUCCESS | 0x00000000 | |
| 09:18:23,828 | 1640 | RegEnumValueW |
Index => 4 Handle => 0x00000458 Data => C\x00:\x00\x00\x00 ValueName => HOMEDRIVE |
SUCCESS | 0x00000000 | |
| 09:18:23,828 | 1640 | RegEnumValueW |
Index => 5 Handle => 0x00000458 Data => \x00\x00 ValueName => HOMESHARE |
SUCCESS | 0x00000000 | |
| 09:18:23,828 | 1640 | RegEnumValueW |
Index => 6 Handle => 0x00000458 Data => \\x00D\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00s\x00 \x00a\x00n\x00d\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00D\x00W\x00\x00\x00 ValueName => HOMEPATH |
SUCCESS | 0x00000000 | |
| 09:18:23,828 | 1640 | RegEnumValueW |
Index => 7 Handle => 0x00000458 DataLength => 4096 ValueName => HOMEPATH Type => 33288356 |
FAILURE | 0x00000103 | |
| 09:18:23,828 | 1640 | RegCloseKey |
Handle => 0x00000458 |
SUCCESS | 0x00000000 | |
| 09:18:23,828 | 1640 | RegCloseKey |
Handle => 0x0000044c |
SUCCESS | 0x00000000 | |
| 09:18:23,828 | 1640 | NtFreeVirtualMemory |
FreeType => 0x00008000 ProcessHandle => 0xffffffff RegionSize => 0x00001000 BaseAddress => 0x029f0000 |
SUCCESS | 0x00000000 | |
| 09:18:23,828 | 1640 | RegCloseKey |
Handle => 0x00000454 |
SUCCESS | 0x00000000 | |
| 09:18:23,828 | 1640 | RegOpenKeyExW |
Handle => 0x00000454 Registry => 0x80000003 SubKey => S-1-5-21-1935655697-1606980848-1060284298-1003 |
SUCCESS | 0x00000000 | |
| 09:18:23,828 | 1640 | RegCreateKeyExW |
Handle => 0x0000044c Access => 33554432 Registry => 0x00000454 Class => SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders |
SUCCESS | 0x00000000 | |
| 09:18:23,828 | 1640 | RegCloseKey |
Handle => 0x00000454 |
SUCCESS | 0x00000000 | |
| 09:18:23,828 | 1640 | RegSetValueExW |
Handle => 0x0000044c Buffer => C\x00:\x00\\x00D\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00s\x00 \x00a\x00n\x00d\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00D\x00W\x00\\x00A\x00p\x00p\x00l\x00i\x00c\x00a\x00t\x00i\x00o\x00n\x00 \x00D\x00a\x00t\x00a\x00\x00\x00 ValueName => AppData Type => 1 |
SUCCESS | 0x00000000 | |
| 09:18:23,828 | 1640 | RegCloseKey |
Handle => 0x0000044c |
SUCCESS | 0x00000000 | |
| 09:18:23,828 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Microsoft\Network\Connections\Pbk\*.pbk |
SUCCESS | 4294967295 | |
| 09:18:23,828 | 1640 | RegCreateKeyExA |
Handle => 0x00000448 Access => 2 Registry => 0x0000043c Class => SubKey => Software\Microsoft\windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:18:23,828 | 1640 | RegSetValueExA |
Handle => 0x00000448 Buffer => 1 ValueName => MigrateProxy Type => 4 |
SUCCESS | 0x00000000 | |
| 09:18:23,828 | 1640 | RegCloseKey |
Handle => 0x00000448 |
SUCCESS | 0x00000000 | |
| 09:18:23,828 | 1640 | RegOpenKeyExA |
Handle => 0x00000448 Registry => 0x0000043c SubKey => Software\Microsoft\windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:18:23,828 | 1640 | RegQueryValueExA |
Handle => 0x00000448 Data => 0 ValueName => ProxyEnable |
SUCCESS | 0x00000000 | |
| 09:18:23,828 | 1640 | RegQueryValueExA |
Handle => 0x00000448 DataLength => 2084 ValueName => ProxyServer Type => 1096 |
FAILURE | 0x00000002 | |
| 09:18:23,828 | 1640 | RegQueryValueExA |
Handle => 0x00000448 DataLength => 2084 ValueName => ProxyOverride Type => 1096 |
FAILURE | 0x00000002 | |
| 09:18:23,828 | 1640 | RegQueryValueExA |
Handle => 0x00000448 DataLength => 2084 ValueName => AutoConfigURL Type => 1096 |
FAILURE | 0x00000002 | |
| 09:18:23,828 | 1640 | RegCloseKey |
Handle => 0x00000448 |
SUCCESS | 0x00000000 | |
| 09:18:23,828 | 1640 | RegCreateKeyExA |
Handle => 0x00000448 Access => 1 Registry => 0x0000043c Class => SubKey => Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections |
SUCCESS | 0x00000000 | |
| 09:18:23,828 | 1640 | RegQueryValueExA |
Handle => 0x00000448 DataLength => 56 ValueName => SavedLegacySettings Type => 3 |
SUCCESS | 0x00000000 | |
| 09:18:23,828 | 1640 | RegQueryValueExA |
Handle => 0x00000448 Data => ValueName => SavedLegacySettings |
SUCCESS | 0x00000000 | |
| 09:18:23,828 | 1640 | RegCloseKey |
Handle => 0x00000448 |
SUCCESS | 0x00000000 | |
| 09:18:23,828 | 1640 | RegCreateKeyExA |
Handle => 0x00000448 Access => 1 Registry => 0x0000043c Class => SubKey => Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections |
SUCCESS | 0x00000000 | |
| 09:18:23,828 | 1640 | RegQueryValueExA |
Handle => 0x00000448 DataLength => 56 ValueName => DefaultConnectionSettings Type => 3 |
SUCCESS | 0x00000000 | |
| 09:18:23,828 | 1640 | RegQueryValueExA |
Handle => 0x00000448 Data => ValueName => DefaultConnectionSettings |
SUCCESS | 0x00000000 | |
| 09:18:23,828 | 1640 | RegCloseKey |
Handle => 0x00000448 |
SUCCESS | 0x00000000 | |
| 09:18:23,828 | 1640 | RegCreateKeyExA |
Handle => 0x00000448 Access => 131078 Registry => 0x0000043c Class => SubKey => Software\Microsoft\windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:18:23,828 | 1640 | RegSetValueExA |
Handle => 0x00000448 Buffer => 0 ValueName => ProxyEnable Type => 4 |
SUCCESS | 0x00000000 | |
| 09:18:23,828 | 1640 | RegDeleteValueA |
Handle => 0x00000448 ValueName => ProxyServer |
FAILURE | 0x00000002 | |
| 09:18:23,828 | 1640 | RegDeleteValueA |
Handle => 0x00000448 ValueName => ProxyOverride |
FAILURE | 0x00000002 | |
| 09:18:23,828 | 1640 | RegDeleteValueA |
Handle => 0x00000448 ValueName => AutoConfigURL |
FAILURE | 0x00000002 | |
| 09:18:23,828 | 1640 | RegCloseKey |
Handle => 0x00000448 |
SUCCESS | 0x00000000 | |
| 09:18:23,828 | 1640 | RegCreateKeyExA |
Handle => 0x00000448 Access => 2 Registry => 0x80000005 Class => SubKey => Software\Microsoft\windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:18:23,828 | 1640 | RegSetValueExA |
Handle => 0x00000448 Buffer => 0 ValueName => ProxyEnable Type => 4 |
SUCCESS | 0x00000000 | |
| 09:18:23,828 | 1640 | RegCloseKey |
Handle => 0x00000448 |
SUCCESS | 0x00000000 | |
| 09:18:23,828 | 1640 | RegCreateKeyExA |
Handle => 0x00000448 Access => 1 Registry => 0x0000043c Class => SubKey => Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections |
SUCCESS | 0x00000000 | |
| 09:18:23,828 | 1640 | RegQueryValueExA |
Handle => 0x00000448 DataLength => 56 ValueName => SavedLegacySettings Type => 3 |
SUCCESS | 0x00000000 | |
| 09:18:23,828 | 1640 | RegQueryValueExA |
Handle => 0x00000448 Data => ValueName => SavedLegacySettings |
SUCCESS | 0x00000000 | |
| 09:18:23,828 | 1640 | RegCreateKeyExA |
Handle => 0x0000044c Access => 2 Registry => 0x0000043c Class => SubKey => Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections |
SUCCESS | 0x00000000 | |
| 09:18:23,828 | 1640 | RegCloseKey |
Handle => 0x00000448 |
SUCCESS | 0x00000000 | |
| 09:18:23,828 | 1640 | RegSetValueExA |
Handle => 0x0000044c Buffer => ValueName => SavedLegacySettings Type => 3 |
SUCCESS | 0x00000000 | |
| 09:18:23,828 | 1640 | RegCloseKey |
Handle => 0x0000044c |
SUCCESS | 0x00000000 | |
| 09:18:23,828 | 420 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002434f0 | |
| 09:18:23,828 | 420 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002434f0 | |
| 09:18:23,828 | 420 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002434f0 | |
| 09:18:23,828 | 420 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002434f0 | |
| 09:18:23,828 | 420 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000044c |
SUCCESS | 0x00000000 | |
| 09:18:23,828 | 420 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000448 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:23,828 | 420 | NtQueryInformationFile |
FileHandle => 0x0000044c FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01P.\x99\xc0\x8a\xa2\xcf\x01@\x06?\xc0\x8a\xa2\xcf\x01@\x06?\xc0\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:23,828 | 1640 | RegQueryValueExA |
Handle => 0x00000354 DataLength => 4 ValueName => EnableAutodial Type => 852 |
FAILURE | 0x00000002 | |
| 09:18:23,828 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000374 FileInformation => \x00\xc0\x03\x00\x00\x00\x00\x00\x00\xc0\x03\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:18:23,828 | 1640 | getaddrinfo |
ServiceName => NodeName => acroipm2.adobe.com |
FAILURE | 0x00002af9 | |
| 09:18:23,838 | 420 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002434f0 | |
| 09:18:23,838 | 420 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002434f0 | |
| 09:18:23,838 | 420 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002434f0 | |
| 09:18:23,838 | 420 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002434f0 | |
| 09:18:23,838 | 420 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000448 |
SUCCESS | 0x00000000 | |
| 09:18:23,838 | 420 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000454 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:23,838 | 420 | NtQueryInformationFile |
FileHandle => 0x00000448 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\xd0g\xa5\xc0\x8a\xa2\xcf\x01@\x06?\xc0\x8a\xa2\xcf\x01@\x06?\xc0\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:23,838 | 420 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002434f0 | |
| 09:18:23,838 | 420 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002434f0 | |
| 09:18:23,838 | 420 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002434f0 | |
| 09:18:23,838 | 420 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002434f0 | |
| 09:18:23,838 | 420 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000454 |
SUCCESS | 0x00000000 | |
| 09:18:23,838 | 420 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000458 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:23,838 | 420 | NtQueryInformationFile |
FileHandle => 0x00000454 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\x00\xef\xa6\xc0\x8a\xa2\xcf\x01@\x06?\xc0\x8a\xa2\xcf\x01@\x06?\xc0\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:23,838 | 420 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002434f0 | |
| 09:18:23,838 | 420 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002434f0 | |
| 09:18:23,838 | 420 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002434f0 | |
| 09:18:23,848 | 420 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002434f0 | |
| 09:18:23,848 | 420 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000454 |
SUCCESS | 0x00000000 | |
| 09:18:23,848 | 420 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000458 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:23,848 | 420 | NtQueryInformationFile |
FileHandle => 0x00000454 FileInformation => \xa0\xb0\x1c\xbf\x8a\xa2\xcf\x010v\xa8\xc0\x8a\xa2\xcf\x010v\xa8\xc0\x8a\xa2\xcf\x010v\xa8\xc0\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:23,858 | 420 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002434f0 | |
| 09:18:23,858 | 420 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002434f0 | |
| 09:18:23,858 | 420 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002434f0 | |
| 09:18:23,858 | 420 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002434f0 | |
| 09:18:23,858 | 420 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002434f0 | |
| 09:18:23,858 | 420 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002434f0 | |
| 09:18:23,858 | 420 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002434f0 | |
| 09:18:23,858 | 420 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002434f0 | |
| 09:18:23,858 | 420 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000454 |
SUCCESS | 0x00000000 | |
| 09:18:23,868 | 420 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000458 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:23,868 | 420 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002434f0 | |
| 09:18:23,868 | 420 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002434f0 | |
| 09:18:23,868 | 420 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002434f0 | |
| 09:18:23,868 | 420 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002434f0 | |
| 09:18:23,868 | 420 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000454 |
SUCCESS | 0x00000000 | |
| 09:18:23,868 | 420 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000458 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:23,868 | 420 | NtQueryInformationFile |
FileHandle => 0x00000454 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01`\xfd\xa9\xc0\x8a\xa2\xcf\x01`\xfd\xa9\xc0\x8a\xa2\xcf\x01`\xfd\xa9\xc0\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:23,868 | 1640 | getaddrinfo |
ServiceName => NodeName => acroipm2.adobe.com |
SUCCESS | 0x00000000 | |
| 09:18:23,868 | 1640 | socket |
type => 1 protocol => 6 af => 2 |
SUCCESS | 0x00000458 | |
| 09:18:23,878 | 420 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243528 | |
| 09:18:23,878 | 420 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00243528 | |
| 09:18:23,878 | 420 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00243528 | |
| 09:18:23,878 | 420 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00243528 | |
| 09:18:23,878 | 420 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000454 |
SUCCESS | 0x00000000 | |
| 09:18:23,878 | 420 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000045c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:23,878 | 420 | NtQueryInformationFile |
FileHandle => 0x00000454 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\x90\x84\xab\xc0\x8a\xa2\xcf\x01`\xfd\xa9\xc0\x8a\xa2\xcf\x01`\xfd\xa9\xc0\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:23,878 | 1640 | ioctlsocket |
command => 2147772030 socket => 0x00000458 |
SUCCESS | 0x00000000 | |
| 09:18:23,878 | 1640 | bind |
ip => 0.0.0.0 socket => 0x00000458 port => 0 |
SUCCESS | 0x00000000 | |
| 09:18:23,878 | 1640 | NtDeviceIoControlFile |
InputBuffer => FileHandle => 0x00000458 OutputBuffer => \x01\x00\x00\x00\x01\x00\x00\x00\x0e\x00\x02\x00\x04\x11\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:18:23,878 | 1640 | connect |
socket => 0x00000458 |
FAILURE | 4294967295 | |
| 09:18:23,878 | 520 | select |
socket => 0x00000001 |
SUCCESS | 0x00000001 | |
| 09:18:23,888 | 520 | WSARecv |
socket => 0x000003d0 |
SUCCESS | 0x00000000 | |
| 09:18:23,888 | 1640 | send |
buffer => ! socket => 0x000003d0 |
SUCCESS | 0x00000001 | |
| 09:18:23,888 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243528 | |
| 09:18:23,888 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00243528 | |
| 09:18:23,888 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00243528 | |
| 09:18:23,888 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00243528 | |
| 09:18:23,888 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:23,888 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:23,888 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \xa0\xb0\x1c\xbf\x8a\xa2\xcf\x01\xf0\x92\xae\xc0\x8a\xa2\xcf\x01\xf0\x92\xae\xc0\x8a\xa2\xcf\x01\xf0\x92\xae\xc0\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00\x02\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:23,888 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:23,888 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:23,898 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:23,898 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:23,898 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:23,898 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:23,898 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:23,898 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:23,898 | 1640 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:23,898 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:23,898 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:23,898 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:23,898 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:23,898 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:23,898 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:23,898 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:23,898 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\xf0\x92\xae\xc0\x8a\xa2\xcf\x01\xf0\x92\xae\xc0\x8a\xa2\xcf\x01\xf0\x92\xae\xc0\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:23,898 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:23,898 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:23,908 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:23,908 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:23,908 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:23,908 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:23,908 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\xf0\x92\xae\xc0\x8a\xa2\xcf\x01\xf0\x92\xae\xc0\x8a\xa2\xcf\x01\xf0\x92\xae\xc0\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:23,908 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:23,908 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:23,908 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:23,908 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:23,908 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:23,908 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:23,908 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01P\xa1\xb1\xc0\x8a\xa2\xcf\x01\xf0\x92\xae\xc0\x8a\xa2\xcf\x01\xf0\x92\xae\xc0\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:23,918 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:23,918 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:23,918 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:23,918 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:23,918 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:23,918 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:23,918 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01P\xa1\xb1\xc0\x8a\xa2\xcf\x01\xf0\x92\xae\xc0\x8a\xa2\xcf\x01\xf0\x92\xae\xc0\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:23,918 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:23,928 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:23,928 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:23,928 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:23,928 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:23,928 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:23,928 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01P\xa1\xb1\xc0\x8a\xa2\xcf\x01\xf0\x92\xae\xc0\x8a\xa2\xcf\x01\xf0\x92\xae\xc0\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:23,938 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:23,938 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:23,938 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:23,938 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:23,938 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:23,938 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:23,938 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\xb0\xaf\xb4\xc0\x8a\xa2\xcf\x01\xf0\x92\xae\xc0\x8a\xa2\xcf\x01\xf0\x92\xae\xc0\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:23,938 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:23,938 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:23,938 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:23,938 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:23,948 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:23,948 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:23,948 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\xb0\xaf\xb4\xc0\x8a\xa2\xcf\x01\xf0\x92\xae\xc0\x8a\xa2\xcf\x01\xf0\x92\xae\xc0\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:23,948 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:23,948 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:23,948 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:23,948 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:23,948 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:23,948 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:23,948 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\x10\xbe\xb7\xc0\x8a\xa2\xcf\x01\xf0\x92\xae\xc0\x8a\xa2\xcf\x01\xf0\x92\xae\xc0\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:23,958 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:23,958 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:23,958 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:23,958 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:23,958 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:23,958 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:23,958 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\x10\xbe\xb7\xc0\x8a\xa2\xcf\x01\xf0\x92\xae\xc0\x8a\xa2\xcf\x01\xf0\x92\xae\xc0\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:23,958 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:23,958 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:23,958 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:23,958 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:23,958 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:23,958 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:23,958 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\x10\xbe\xb7\xc0\x8a\xa2\xcf\x01\xf0\x92\xae\xc0\x8a\xa2\xcf\x01\xf0\x92\xae\xc0\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:23,978 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:23,978 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:23,978 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:23,978 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:23,978 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:23,978 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:23,978 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01p\xcc\xba\xc0\x8a\xa2\xcf\x01\xf0\x92\xae\xc0\x8a\xa2\xcf\x01\xf0\x92\xae\xc0\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:23,978 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:23,978 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:23,978 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:23,978 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:23,978 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:23,978 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:23,978 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01p\xcc\xba\xc0\x8a\xa2\xcf\x01\xf0\x92\xae\xc0\x8a\xa2\xcf\x01\xf0\x92\xae\xc0\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:23,988 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:23,988 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:23,988 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:23,988 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:23,988 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:23,988 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:23,988 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\xd0\xda\xbd\xc0\x8a\xa2\xcf\x01\xf0\x92\xae\xc0\x8a\xa2\xcf\x01\xf0\x92\xae\xc0\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:23,988 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:23,988 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:23,988 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:23,988 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:23,988 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:23,988 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:23,988 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\xd0\xda\xbd\xc0\x8a\xa2\xcf\x01\xf0\x92\xae\xc0\x8a\xa2\xcf\x01\xf0\x92\xae\xc0\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:23,998 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:23,998 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:23,998 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:23,998 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:23,998 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:23,998 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:23,998 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\xd0\xda\xbd\xc0\x8a\xa2\xcf\x01\xf0\x92\xae\xc0\x8a\xa2\xcf\x01\xf0\x92\xae\xc0\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:23,998 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:23,998 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:23,998 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:23,998 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:23,998 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:23,998 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:23,998 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\x00b\xbf\xc0\x8a\xa2\xcf\x01\xf0\x92\xae\xc0\x8a\xa2\xcf\x01\xf0\x92\xae\xc0\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:24,008 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:24,008 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:24,008 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:24,008 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:24,008 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:24,008 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:24,008 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\x00b\xbf\xc0\x8a\xa2\xcf\x01\xf0\x92\xae\xc0\x8a\xa2\xcf\x01\xf0\x92\xae\xc0\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:24,008 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:24,008 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:24,008 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:24,008 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:24,008 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:24,008 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:24,008 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x010\xe9\xc0\xc0\x8a\xa2\xcf\x01\xf0\x92\xae\xc0\x8a\xa2\xcf\x01\xf0\x92\xae\xc0\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:24,028 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:24,028 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:24,028 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:24,028 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:24,028 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:24,028 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:24,028 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01`p\xc2\xc0\x8a\xa2\xcf\x01\xf0\x92\xae\xc0\x8a\xa2\xcf\x01\xf0\x92\xae\xc0\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:24,028 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:24,028 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:24,028 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:24,028 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:24,028 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:24,028 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:24,028 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01`p\xc2\xc0\x8a\xa2\xcf\x01\xf0\x92\xae\xc0\x8a\xa2\xcf\x01\xf0\x92\xae\xc0\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:24,028 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:24,038 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:24,038 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:24,038 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:24,038 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:24,038 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:24,038 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\x90\xf7\xc3\xc0\x8a\xa2\xcf\x01\xf0\x92\xae\xc0\x8a\xa2\xcf\x01\xf0\x92\xae\xc0\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:24,038 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:24,038 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:24,038 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:24,038 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:24,038 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:24,038 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:24,038 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\xc0~\xc5\xc0\x8a\xa2\xcf\x01\xf0\x92\xae\xc0\x8a\xa2\xcf\x01\xf0\x92\xae\xc0\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:24,038 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:24,048 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:24,048 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:24,048 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:24,048 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:24,048 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:24,048 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\xc0~\xc5\xc0\x8a\xa2\xcf\x01\xf0\x92\xae\xc0\x8a\xa2\xcf\x01\xf0\x92\xae\xc0\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:24,048 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:24,048 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:24,048 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:24,048 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:24,048 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:24,048 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:24,048 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\xf0\x05\xc7\xc0\x8a\xa2\xcf\x01\xf0\x92\xae\xc0\x8a\xa2\xcf\x01\xf0\x92\xae\xc0\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:24,068 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:24,068 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:24,068 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:24,068 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:24,068 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:24,068 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:24,068 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\xf0\x05\xc7\xc0\x8a\xa2\xcf\x01\xf0\x92\xae\xc0\x8a\xa2\xcf\x01\xf0\x92\xae\xc0\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:24,068 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:24,068 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:24,068 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:24,068 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:24,068 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:24,068 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:24,068 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\xf0\x05\xc7\xc0\x8a\xa2\xcf\x01\xf0\x92\xae\xc0\x8a\xa2\xcf\x01\xf0\x92\xae\xc0\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:24,078 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:24,078 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:24,078 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:24,078 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:24,078 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:24,078 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:24,078 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01P\x14\xca\xc0\x8a\xa2\xcf\x01\xf0\x92\xae\xc0\x8a\xa2\xcf\x01\xf0\x92\xae\xc0\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:24,078 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:24,078 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:24,078 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:24,078 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:24,078 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:24,078 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:24,078 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01P\x14\xca\xc0\x8a\xa2\xcf\x01\xf0\x92\xae\xc0\x8a\xa2\xcf\x01\xf0\x92\xae\xc0\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:24,088 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:24,088 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:24,088 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:24,088 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:24,088 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:24,088 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:24,088 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\x80\x9b\xcb\xc0\x8a\xa2\xcf\x01\xf0\x92\xae\xc0\x8a\xa2\xcf\x01\xf0\x92\xae\xc0\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:24,108 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:24,108 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:24,108 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:24,108 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:24,108 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:24,108 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:24,108 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\xb0"\xcd\xc0\x8a\xa2\xcf\x01\xf0\x92\xae\xc0\x8a\xa2\xcf\x01\xf0\x92\xae\xc0\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:24,108 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:24,108 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:24,108 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:24,108 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:24,108 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:24,108 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:24,108 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\xb0"\xcd\xc0\x8a\xa2\xcf\x01\xf0\x92\xae\xc0\x8a\xa2\xcf\x01\xf0\x92\xae\xc0\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:24,108 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:24,118 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:24,118 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:24,118 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:24,118 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:24,118 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:24,118 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\x101\xd0\xc0\x8a\xa2\xcf\x01\xf0\x92\xae\xc0\x8a\xa2\xcf\x01\xf0\x92\xae\xc0\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:24,118 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:24,118 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:24,118 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:24,118 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:24,118 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:24,118 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:24,118 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01@\xb8\xd1\xc0\x8a\xa2\xcf\x01\xf0\x92\xae\xc0\x8a\xa2\xcf\x01\xf0\x92\xae\xc0\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:24,118 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:24,118 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:24,128 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:24,128 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:24,128 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:24,128 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:24,128 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01@\xb8\xd1\xc0\x8a\xa2\xcf\x01\xf0\x92\xae\xc0\x8a\xa2\xcf\x01\xf0\x92\xae\xc0\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:24,128 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:24,128 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:24,128 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:24,128 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:24,128 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:24,128 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:24,128 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01p?\xd3\xc0\x8a\xa2\xcf\x01\xf0\x92\xae\xc0\x8a\xa2\xcf\x01\xf0\x92\xae\xc0\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:24,148 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:24,148 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:24,148 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:24,148 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:24,148 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:24,148 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:24,148 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01p?\xd3\xc0\x8a\xa2\xcf\x01\xf0\x92\xae\xc0\x8a\xa2\xcf\x01\xf0\x92\xae\xc0\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:24,148 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:24,148 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:24,148 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:24,148 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:24,148 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:24,148 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:24,148 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01p?\xd3\xc0\x8a\xa2\xcf\x01\xf0\x92\xae\xc0\x8a\xa2\xcf\x01\xf0\x92\xae\xc0\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:24,148 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:24,148 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:24,158 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:24,158 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:24,158 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:24,158 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:24,158 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\xd0M\xd6\xc0\x8a\xa2\xcf\x01\xf0\x92\xae\xc0\x8a\xa2\xcf\x01\xf0\x92\xae\xc0\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:24,158 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:24,158 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:24,158 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:24,158 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:24,158 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:24,158 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:24,158 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\x00\xd5\xd7\xc0\x8a\xa2\xcf\x01\xf0\x92\xae\xc0\x8a\xa2\xcf\x01\xf0\x92\xae\xc0\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:24,158 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:24,168 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:24,168 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:24,168 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:24,168 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:24,168 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:24,168 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\x00\xd5\xd7\xc0\x8a\xa2\xcf\x01\xf0\x92\xae\xc0\x8a\xa2\xcf\x01\xf0\x92\xae\xc0\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:24,168 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:24,168 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:24,168 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:24,168 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:24,168 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:24,168 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:24,168 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x010\\xd9\xc0\x8a\xa2\xcf\x01\xf0\x92\xae\xc0\x8a\xa2\xcf\x01\xf0\x92\xae\xc0\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:24,188 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:24,188 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:24,188 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:24,188 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:24,188 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:24,188 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:24,188 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x010\\xd9\xc0\x8a\xa2\xcf\x01\xf0\x92\xae\xc0\x8a\xa2\xcf\x01\xf0\x92\xae\xc0\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:24,188 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:24,188 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:24,188 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:24,188 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:24,188 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:24,188 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:24,188 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x010\\xd9\xc0\x8a\xa2\xcf\x01\xf0\x92\xae\xc0\x8a\xa2\xcf\x01\xf0\x92\xae\xc0\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:24,188 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:24,199 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:24,199 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:24,199 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:24,199 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:24,199 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:24,199 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\x90j\xdc\xc0\x8a\xa2\xcf\x01\xf0\x92\xae\xc0\x8a\xa2\xcf\x01\xf0\x92\xae\xc0\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:24,199 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:24,199 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:24,199 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:24,199 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:24,199 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:24,199 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:24,199 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\xc0\xf1\xdd\xc0\x8a\xa2\xcf\x01\xf0\x92\xae\xc0\x8a\xa2\xcf\x01\xf0\x92\xae\xc0\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:24,199 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:24,209 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:24,209 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:24,209 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:24,209 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:24,209 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:24,209 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\xc0\xf1\xdd\xc0\x8a\xa2\xcf\x01\xf0\x92\xae\xc0\x8a\xa2\xcf\x01\xf0\x92\xae\xc0\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:24,209 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:24,209 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:24,209 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:24,209 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:24,209 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:24,209 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:24,219 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\xf0x\xdf\xc0\x8a\xa2\xcf\x01\xf0\x92\xae\xc0\x8a\xa2\xcf\x01\xf0\x92\xae\xc0\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:24,229 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:24,229 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:24,229 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:24,229 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:24,229 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:24,229 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:24,229 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01 \x00\xe1\xc0\x8a\xa2\xcf\x01\xf0\x92\xae\xc0\x8a\xa2\xcf\x01\xf0\x92\xae\xc0\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:24,229 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:24,229 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:24,229 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:24,229 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:24,229 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:24,229 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:24,229 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01P\x87\xe2\xc0\x8a\xa2\xcf\x01\xf0\x92\xae\xc0\x8a\xa2\xcf\x01\xf0\x92\xae\xc0\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:24,229 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:24,239 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:24,239 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:24,239 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:24,239 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:24,239 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:24,239 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01P\x87\xe2\xc0\x8a\xa2\xcf\x01\xf0\x92\xae\xc0\x8a\xa2\xcf\x01\xf0\x92\xae\xc0\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:24,239 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:24,239 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:24,239 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:24,239 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:24,239 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:24,239 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:24,239 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \xa0\xb0\x1c\xbf\x8a\xa2\xcf\x01\x80\x0e\xe4\xc0\x8a\xa2\xcf\x01\x80\x0e\xe4\xc0\x8a\xa2\xcf\x01\x80\x0e\xe4\xc0\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00\x03\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:24,249 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:24,249 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:24,249 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:24,249 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:24,249 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:24,249 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:24,249 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:24,249 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:24,249 | 1640 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:24,249 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:24,249 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:24,259 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:24,259 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:24,259 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:24,259 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:24,259 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:24,259 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\xb0\x95\xe5\xc0\x8a\xa2\xcf\x01\xb0\x95\xe5\xc0\x8a\xa2\xcf\x01\xb0\x95\xe5\xc0\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:24,259 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:24,259 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:24,259 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:24,259 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:24,259 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:24,259 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:24,259 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\xe0\x1c\xe7\xc0\x8a\xa2\xcf\x01\xb0\x95\xe5\xc0\x8a\xa2\xcf\x01\xb0\x95\xe5\xc0\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:24,259 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:24,259 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:24,269 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:24,269 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:24,269 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:24,269 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:24,269 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \xa0\xb0\x1c\xbf\x8a\xa2\xcf\x01\x10\xa4\xe8\xc0\x8a\xa2\xcf\x01\x10\xa4\xe8\xc0\x8a\xa2\xcf\x01\x10\xa4\xe8\xc0\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00\x04\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:24,269 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:24,269 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:24,269 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:24,279 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:24,279 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:24,279 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:24,279 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:24,279 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:24,279 | 1640 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:24,279 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:24,279 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:24,279 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:24,279 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:24,279 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:24,279 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:24,279 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:24,279 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\x10\xa4\xe8\xc0\x8a\xa2\xcf\x01\x10\xa4\xe8\xc0\x8a\xa2\xcf\x01\x10\xa4\xe8\xc0\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:24,279 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:24,279 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:24,289 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:24,289 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:24,289 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:24,289 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:24,289 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\x10\xa4\xe8\xc0\x8a\xa2\xcf\x01\x10\xa4\xe8\xc0\x8a\xa2\xcf\x01\x10\xa4\xe8\xc0\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:24,289 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:24,289 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:24,289 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:24,289 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:24,289 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:24,289 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:24,289 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01p\xb2\xeb\xc0\x8a\xa2\xcf\x01\x10\xa4\xe8\xc0\x8a\xa2\xcf\x01\x10\xa4\xe8\xc0\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:24,299 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:24,299 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:24,299 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:24,299 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:24,299 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:24,299 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:24,299 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01p\xb2\xeb\xc0\x8a\xa2\xcf\x01\x10\xa4\xe8\xc0\x8a\xa2\xcf\x01\x10\xa4\xe8\xc0\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:24,299 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:24,299 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:24,299 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:24,299 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:24,299 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:24,299 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:24,299 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01p\xb2\xeb\xc0\x8a\xa2\xcf\x01\x10\xa4\xe8\xc0\x8a\xa2\xcf\x01\x10\xa4\xe8\xc0\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:24,319 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:24,319 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:24,319 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:24,319 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:24,319 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:24,319 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:24,319 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\xd0\xc0\xee\xc0\x8a\xa2\xcf\x01\x10\xa4\xe8\xc0\x8a\xa2\xcf\x01\x10\xa4\xe8\xc0\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:24,319 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:24,319 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:24,319 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:24,319 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:24,319 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:24,319 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:24,319 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\xd0\xc0\xee\xc0\x8a\xa2\xcf\x01\x10\xa4\xe8\xc0\x8a\xa2\xcf\x01\x10\xa4\xe8\xc0\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:24,329 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:24,329 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:24,329 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:24,329 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:24,329 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:24,329 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:24,329 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\x00H\xf0\xc0\x8a\xa2\xcf\x01\x10\xa4\xe8\xc0\x8a\xa2\xcf\x01\x10\xa4\xe8\xc0\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:24,329 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:24,329 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:24,329 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:24,329 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:24,329 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:24,329 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:24,329 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\x00H\xf0\xc0\x8a\xa2\xcf\x01\x10\xa4\xe8\xc0\x8a\xa2\xcf\x01\x10\xa4\xe8\xc0\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:24,339 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:24,339 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:24,339 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:24,339 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:24,339 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:24,339 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:24,339 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01`V\xf3\xc0\x8a\xa2\xcf\x01\x10\xa4\xe8\xc0\x8a\xa2\xcf\x01\x10\xa4\xe8\xc0\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:24,339 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:24,339 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:24,339 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:24,339 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:24,339 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:24,339 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:24,339 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01`V\xf3\xc0\x8a\xa2\xcf\x01\x10\xa4\xe8\xc0\x8a\xa2\xcf\x01\x10\xa4\xe8\xc0\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:24,349 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:24,349 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:24,349 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:24,349 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:24,349 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:24,349 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:24,349 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01`V\xf3\xc0\x8a\xa2\xcf\x01\x10\xa4\xe8\xc0\x8a\xa2\xcf\x01\x10\xa4\xe8\xc0\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:24,349 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:24,349 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:24,349 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:24,349 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:24,349 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:24,349 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:24,359 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01`V\xf3\xc0\x8a\xa2\xcf\x01\x10\xa4\xe8\xc0\x8a\xa2\xcf\x01\x10\xa4\xe8\xc0\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:24,359 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:24,359 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:24,359 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:24,359 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:24,359 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:24,359 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:24,359 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\xc0d\xf6\xc0\x8a\xa2\xcf\x01\x10\xa4\xe8\xc0\x8a\xa2\xcf\x01\x10\xa4\xe8\xc0\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:24,369 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:24,369 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:24,369 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:24,369 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:24,369 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:24,369 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:24,369 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\xc0d\xf6\xc0\x8a\xa2\xcf\x01\x10\xa4\xe8\xc0\x8a\xa2\xcf\x01\x10\xa4\xe8\xc0\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:24,369 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:24,369 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:24,369 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:24,369 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:24,369 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:24,369 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:24,369 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\xc0d\xf6\xc0\x8a\xa2\xcf\x01\x10\xa4\xe8\xc0\x8a\xa2\xcf\x01\x10\xa4\xe8\xc0\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:24,379 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:24,379 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:24,379 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:24,379 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:24,379 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:24,379 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:24,379 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\xf0\xeb\xf7\xc0\x8a\xa2\xcf\x01\x10\xa4\xe8\xc0\x8a\xa2\xcf\x01\x10\xa4\xe8\xc0\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:24,379 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:24,379 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:24,379 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:24,379 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:24,379 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:24,379 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:24,379 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\xf0\xeb\xf7\xc0\x8a\xa2\xcf\x01\x10\xa4\xe8\xc0\x8a\xa2\xcf\x01\x10\xa4\xe8\xc0\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:24,389 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:24,389 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:24,389 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:24,389 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:24,389 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:24,389 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:24,389 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01P\xfa\xfa\xc0\x8a\xa2\xcf\x01\x10\xa4\xe8\xc0\x8a\xa2\xcf\x01\x10\xa4\xe8\xc0\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:24,389 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:24,389 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:24,389 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:24,389 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:24,389 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:24,389 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:24,389 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01P\xfa\xfa\xc0\x8a\xa2\xcf\x01\x10\xa4\xe8\xc0\x8a\xa2\xcf\x01\x10\xa4\xe8\xc0\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:24,409 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:24,409 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:24,409 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:24,409 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:24,409 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:24,409 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:24,409 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\x80\x81\xfc\xc0\x8a\xa2\xcf\x01\x10\xa4\xe8\xc0\x8a\xa2\xcf\x01\x10\xa4\xe8\xc0\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:24,409 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:24,409 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:24,409 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:24,409 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:24,409 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:24,409 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:24,409 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\x80\x81\xfc\xc0\x8a\xa2\xcf\x01\x10\xa4\xe8\xc0\x8a\xa2\xcf\x01\x10\xa4\xe8\xc0\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:24,419 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:24,419 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:24,419 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:24,419 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:24,419 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:24,419 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:24,419 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\xe0\x8f\xff\xc0\x8a\xa2\xcf\x01\x10\xa4\xe8\xc0\x8a\xa2\xcf\x01\x10\xa4\xe8\xc0\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:24,419 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:24,419 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:24,419 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:24,419 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:24,419 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:24,429 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:24,429 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\xe0\x8f\xff\xc0\x8a\xa2\xcf\x01\x10\xa4\xe8\xc0\x8a\xa2\xcf\x01\x10\xa4\xe8\xc0\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:24,429 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:24,429 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:24,429 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:24,429 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:24,429 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:24,429 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:24,429 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\x10\x17\x01\xc1\x8a\xa2\xcf\x01\x10\xa4\xe8\xc0\x8a\xa2\xcf\x01\x10\xa4\xe8\xc0\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:24,429 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:24,439 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:24,439 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:24,439 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:24,439 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:24,439 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:24,439 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\x10\x17\x01\xc1\x8a\xa2\xcf\x01\x10\xa4\xe8\xc0\x8a\xa2\xcf\x01\x10\xa4\xe8\xc0\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:24,449 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:24,449 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:24,449 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:24,449 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:24,449 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:24,449 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:24,449 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01@\x9e\x02\xc1\x8a\xa2\xcf\x01\x10\xa4\xe8\xc0\x8a\xa2\xcf\x01\x10\xa4\xe8\xc0\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:24,449 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:24,449 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:24,449 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:24,449 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:24,449 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:24,449 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:24,449 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01@\x9e\x02\xc1\x8a\xa2\xcf\x01\x10\xa4\xe8\xc0\x8a\xa2\xcf\x01\x10\xa4\xe8\xc0\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:24,459 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:24,459 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:24,459 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:24,459 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:24,459 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:24,459 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:24,459 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01p%\x04\xc1\x8a\xa2\xcf\x01\x10\xa4\xe8\xc0\x8a\xa2\xcf\x01\x10\xa4\xe8\xc0\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:24,459 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:24,459 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:24,459 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:24,459 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:24,459 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:24,459 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:24,459 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01p%\x04\xc1\x8a\xa2\xcf\x01\x10\xa4\xe8\xc0\x8a\xa2\xcf\x01\x10\xa4\xe8\xc0\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:24,469 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:24,469 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:24,469 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:24,469 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:24,469 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:24,469 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:24,469 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\xd03\x07\xc1\x8a\xa2\xcf\x01\x10\xa4\xe8\xc0\x8a\xa2\xcf\x01\x10\xa4\xe8\xc0\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:24,469 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:24,469 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:24,469 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:24,469 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:24,469 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:24,469 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:24,479 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\xd03\x07\xc1\x8a\xa2\xcf\x01\x10\xa4\xe8\xc0\x8a\xa2\xcf\x01\x10\xa4\xe8\xc0\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:24,479 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:24,479 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:24,479 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:24,479 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:24,479 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:24,479 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:24,479 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\xd03\x07\xc1\x8a\xa2\xcf\x01\x10\xa4\xe8\xc0\x8a\xa2\xcf\x01\x10\xa4\xe8\xc0\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:24,479 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:24,479 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:24,479 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:24,479 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:24,479 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:24,479 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:24,489 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\x00\xbb\x08\xc1\x8a\xa2\xcf\x01\x10\xa4\xe8\xc0\x8a\xa2\xcf\x01\x10\xa4\xe8\xc0\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:24,599 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:24,599 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:24,599 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:24,599 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:24,599 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:24,599 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:24,599 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x010B \xc1\x8a\xa2\xcf\x01\x10\xa4\xe8\xc0\x8a\xa2\xcf\x01\x10\xa4\xe8\xc0\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:24,599 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:24,599 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:24,599 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:24,599 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:24,599 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:24,599 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:24,599 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01@\x11\x1b\xc1\x8a\xa2\xcf\x01\x10\xa4\xe8\xc0\x8a\xa2\xcf\x01\x10\xa4\xe8\xc0\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:24,599 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:24,609 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:24,609 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:24,609 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:24,609 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:24,609 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:24,609 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01@\x11\x1b\xc1\x8a\xa2\xcf\x01\x10\xa4\xe8\xc0\x8a\xa2\xcf\x01\x10\xa4\xe8\xc0\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:24,609 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:24,609 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:24,609 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:24,609 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:24,609 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:24,609 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:24,609 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \xa0\xb0\x1c\xbf\x8a\xa2\xcf\x01p\x98\x1c\xc1\x8a\xa2\xcf\x01p\x98\x1c\xc1\x8a\xa2\xcf\x01p\x98\x1c\xc1\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00\x05\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:24,619 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:24,619 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:24,619 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:24,619 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:24,619 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:24,619 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:24,619 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:24,619 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:24,619 | 1640 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:24,619 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:24,619 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:24,629 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:24,629 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:24,629 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:24,629 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:24,629 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:24,629 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\xa0\x1f\x1e\xc1\x8a\xa2\xcf\x01\xa0\x1f\x1e\xc1\x8a\xa2\xcf\x01\xa0\x1f\x1e\xc1\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:24,629 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:24,629 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:24,629 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:24,629 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:24,629 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:24,629 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:24,629 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\xd0\xa6\x1f\xc1\x8a\xa2\xcf\x01\xa0\x1f\x1e\xc1\x8a\xa2\xcf\x01\xa0\x1f\x1e\xc1\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:24,629 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:24,639 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:24,639 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:24,639 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:24,659 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:24,659 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:24,659 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \xa0\xb0\x1c\xbf\x8a\xa2\xcf\x01\x00.!\xc1\x8a\xa2\xcf\x01\x00.!\xc1\x8a\xa2\xcf\x01\x00.!\xc1\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00\x06\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:24,749 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:24,749 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:24,749 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:24,749 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:24,749 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:24,749 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:24,749 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:24,749 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:24,749 | 1640 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:24,749 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:25,060 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:25,060 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:25,060 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:25,060 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:25,060 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:25,060 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:25,060 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\x10\xfd1\xc1\x8a\xa2\xcf\x01\x10\xfd1\xc1\x8a\xa2\xcf\x01\x10\xfd1\xc1\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:25,070 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:25,070 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:25,070 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:25,070 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:25,070 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:25,080 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:25,080 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\x10\xe3b\xc1\x8a\xa2\xcf\x01\x10\xfd1\xc1\x8a\xa2\xcf\x01\x10\xfd1\xc1\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:25,080 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:25,080 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:25,080 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:25,080 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:25,080 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:25,090 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:25,090 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01@jd\xc1\x8a\xa2\xcf\x01\x10\xfd1\xc1\x8a\xa2\xcf\x01\x10\xfd1\xc1\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:25,090 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:25,100 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:25,100 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:25,100 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:25,100 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:25,100 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:25,100 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \xa0\xb0\x1c\xbf\x8a\xa2\xcf\x01\xa0xg\xc1\x8a\xa2\xcf\x01\xa0xg\xc1\x8a\xa2\xcf\x01\xa0xg\xc1\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00\x07\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:25,120 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:25,120 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:25,120 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:25,120 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:25,120 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:25,120 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:25,120 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:25,120 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:25,130 | 1640 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:25,130 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:25,130 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:25,130 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:25,130 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:25,130 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:25,130 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:25,130 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:25,140 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\xd0\xffh\xc1\x8a\xa2\xcf\x01\xd0\xffh\xc1\x8a\xa2\xcf\x01\xd0\xffh\xc1\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:25,140 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:25,140 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:25,140 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:25,140 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:25,140 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:25,140 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:25,140 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01`\x95m\xc1\x8a\xa2\xcf\x01\xd0\xffh\xc1\x8a\xa2\xcf\x01\xd0\xffh\xc1\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:25,150 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:25,150 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:25,150 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:25,150 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:25,150 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:25,150 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:25,150 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \xa0\xb0\x1c\xbf\x8a\xa2\xcf\x01\x90\x1co\xc1\x8a\xa2\xcf\x01\x90\x1co\xc1\x8a\xa2\xcf\x01\x90\x1co\xc1\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00\x08\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:25,160 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:25,160 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:25,160 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:25,160 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:25,160 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:25,160 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:25,160 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:25,170 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:25,170 | 1640 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:25,170 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:25,490 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:25,490 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:25,490 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:25,490 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:25,490 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:25,490 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:25,490 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\xc0\xa3p\xc1\x8a\xa2\xcf\x01\xc0\xa3p\xc1\x8a\xa2\xcf\x01\xc0\xa3p\xc1\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:25,500 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:25,500 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:25,500 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:25,500 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:25,500 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:25,500 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:25,500 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01 \x98\xa4\xc1\x8a\xa2\xcf\x01\xc0\xa3p\xc1\x8a\xa2\xcf\x01\xc0\xa3p\xc1\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:25,510 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:25,510 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:25,510 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:25,510 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:25,510 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:25,520 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:25,520 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01P\x1f\xa6\xc1\x8a\xa2\xcf\x01\xc0\xa3p\xc1\x8a\xa2\xcf\x01\xc0\xa3p\xc1\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:25,520 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:25,520 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:25,520 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:25,520 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:25,520 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:25,520 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:25,520 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \xa0\xb0\x1c\xbf\x8a\xa2\xcf\x01\x80\xa6\xa7\xc1\x8a\xa2\xcf\x01\x80\xa6\xa7\xc1\x8a\xa2\xcf\x01\x80\xa6\xa7\xc1\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:25,540 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:25,540 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:25,540 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:25,540 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:25,550 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:25,550 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:25,550 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:25,550 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:25,550 | 1640 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:25,550 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:25,550 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:25,550 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:25,560 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:25,560 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:25,560 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:25,560 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:25,560 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\xe0\xb4\xaa\xc1\x8a\xa2\xcf\x01\xe0\xb4\xaa\xc1\x8a\xa2\xcf\x01\xe0\xb4\xaa\xc1\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:25,560 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:25,560 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:25,560 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:25,570 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:25,570 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:25,570 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:25,570 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01@\xc3\xad\xc1\x8a\xa2\xcf\x01\xe0\xb4\xaa\xc1\x8a\xa2\xcf\x01\xe0\xb4\xaa\xc1\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:25,570 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:25,570 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:25,570 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:25,570 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:25,580 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:25,580 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:25,580 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \xa0\xb0\x1c\xbf\x8a\xa2\xcf\x01\xa0\xd1\xb0\xc1\x8a\xa2\xcf\x01\xa0\xd1\xb0\xc1\x8a\xa2\xcf\x01\xa0\xd1\xb0\xc1\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:25,711 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:25,711 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:25,721 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:25,721 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:25,721 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:25,721 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:25,721 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:25,721 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:25,721 | 1640 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:25,721 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:26,031 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:26,031 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:26,031 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:26,031 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:26,031 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:26,031 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:26,031 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\x10\xaf\xc4\xc1\x8a\xa2\xcf\x01\x10\xaf\xc4\xc1\x8a\xa2\xcf\x01\x10\xaf\xc4\xc1\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:26,031 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:26,031 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:26,031 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:26,031 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:26,031 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:26,031 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:26,041 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\x10\x95\xf5\xc1\x8a\xa2\xcf\x01\x10\xaf\xc4\xc1\x8a\xa2\xcf\x01\x10\xaf\xc4\xc1\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:26,041 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:26,041 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:26,041 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:26,041 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:26,041 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:26,041 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:26,041 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01@\x1c\xf7\xc1\x8a\xa2\xcf\x01\x10\xaf\xc4\xc1\x8a\xa2\xcf\x01\x10\xaf\xc4\xc1\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:26,041 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:26,041 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:26,041 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:26,041 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:26,041 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:26,041 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:26,041 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \xa0\xb0\x1c\xbf\x8a\xa2\xcf\x01@\x1c\xf7\xc1\x8a\xa2\xcf\x01@\x1c\xf7\xc1\x8a\xa2\xcf\x01@\x1c\xf7\xc1\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00\x0b\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:26,051 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:26,051 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:26,051 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:26,051 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:26,061 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:26,061 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:26,061 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:26,061 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:26,061 | 1640 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:26,061 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:26,061 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:26,061 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:26,061 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:26,061 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:26,061 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:26,061 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:26,061 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01p\xa3\xf8\xc1\x8a\xa2\xcf\x01p\xa3\xf8\xc1\x8a\xa2\xcf\x01p\xa3\xf8\xc1\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:26,061 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:26,061 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:26,061 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:26,071 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:26,071 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:26,071 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:26,071 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\xa0*\xfa\xc1\x8a\xa2\xcf\x01p\xa3\xf8\xc1\x8a\xa2\xcf\x01p\xa3\xf8\xc1\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:26,071 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:26,071 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:26,071 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:26,071 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:26,071 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:26,071 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:26,071 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \xa0\xb0\x1c\xbf\x8a\xa2\xcf\x01\xd0\xb1\xfb\xc1\x8a\xa2\xcf\x01\xd0\xb1\xfb\xc1\x8a\xa2\xcf\x01\xd0\xb1\xfb\xc1\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00\x0c\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:26,081 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:26,081 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:26,081 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:26,081 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:26,081 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:26,081 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:26,081 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:26,081 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:26,081 | 1640 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:26,091 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:26,402 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:26,402 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:26,402 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:26,402 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:26,402 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:26,402 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:26,402 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\x009\xfd\xc1\x8a\xa2\xcf\x01\x009\xfd\xc1\x8a\xa2\xcf\x01\x009\xfd\xc1\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:26,412 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:26,412 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:26,412 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:26,412 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:26,412 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:26,412 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:26,422 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\x00\x1f.\xc2\x8a\xa2\xcf\x01\x009\xfd\xc1\x8a\xa2\xcf\x01\x009\xfd\xc1\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:26,422 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:26,422 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:26,422 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:26,422 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:26,432 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:26,432 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:26,432 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01`-1\xc2\x8a\xa2\xcf\x01\x009\xfd\xc1\x8a\xa2\xcf\x01\x009\xfd\xc1\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:26,432 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:26,432 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:26,432 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:26,432 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:26,432 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:26,432 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:26,442 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \xa0\xb0\x1c\xbf\x8a\xa2\xcf\x01\x90\xb42\xc2\x8a\xa2\xcf\x01\x90\xb42\xc2\x8a\xa2\xcf\x01\x90\xb42\xc2\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:26,452 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:26,452 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:26,452 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:26,452 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:26,452 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:26,452 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:26,452 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:26,452 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:26,452 | 1640 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:26,452 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:26,462 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:26,462 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:26,462 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:26,462 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:26,462 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:26,462 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:26,462 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\xf0\xc25\xc2\x8a\xa2\xcf\x01\xf0\xc25\xc2\x8a\xa2\xcf\x01\xf0\xc25\xc2\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:26,462 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:26,462 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:26,462 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:26,462 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:26,462 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:26,462 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:26,462 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01 J7\xc2\x8a\xa2\xcf\x01\xf0\xc25\xc2\x8a\xa2\xcf\x01\xf0\xc25\xc2\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:26,472 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:26,472 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:26,472 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:26,472 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:26,472 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:26,472 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:26,472 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \xa0\xb0\x1c\xbf\x8a\xa2\xcf\x01P\xd18\xc2\x8a\xa2\xcf\x01P\xd18\xc2\x8a\xa2\xcf\x01P\xd18\xc2\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00\x0e\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:26,482 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:26,482 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:26,492 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:26,492 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:26,492 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:26,492 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:26,492 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:26,492 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:26,492 | 1640 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:26,492 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:26,802 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:26,802 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:26,802 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:26,802 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:26,802 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:26,802 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:26,802 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\x80X:\xc2\x8a\xa2\xcf\x01\x80X:\xc2\x8a\xa2\xcf\x01\x80X:\xc2\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:26,812 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:26,812 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:26,812 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:26,812 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:26,812 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:26,812 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:26,812 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\x80>k\xc2\x8a\xa2\xcf\x01\x80X:\xc2\x8a\xa2\xcf\x01\x80X:\xc2\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:26,822 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:26,822 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:26,822 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:26,822 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:26,822 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:26,822 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:26,822 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\xb0\xc5l\xc2\x8a\xa2\xcf\x01\x80X:\xc2\x8a\xa2\xcf\x01\x80X:\xc2\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:26,832 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:26,832 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:26,832 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:26,832 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:26,832 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:26,832 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:26,832 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \xa0\xb0\x1c\xbf\x8a\xa2\xcf\x01\x10\xd4o\xc2\x8a\xa2\xcf\x01\x10\xd4o\xc2\x8a\xa2\xcf\x01\x10\xd4o\xc2\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00\x0f\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:26,842 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:26,842 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:26,842 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:26,852 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:26,852 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:26,852 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:26,852 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:26,852 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:26,852 | 1640 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:26,852 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:26,852 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:26,852 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:26,852 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:26,862 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:26,862 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:26,862 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:26,862 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01@[q\xc2\x8a\xa2\xcf\x01@[q\xc2\x8a\xa2\xcf\x01@[q\xc2\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:26,862 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:26,862 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:26,862 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:26,862 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:26,872 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:26,872 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:26,872 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\xa0it\xc2\x8a\xa2\xcf\x01@[q\xc2\x8a\xa2\xcf\x01@[q\xc2\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:26,872 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:26,872 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:26,872 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:26,872 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:26,872 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:26,882 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:26,882 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \xa0\xb0\x1c\xbf\x8a\xa2\xcf\x01\xd0\xf0u\xc2\x8a\xa2\xcf\x01\xd0\xf0u\xc2\x8a\xa2\xcf\x01\xd0\xf0u\xc2\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00\x10\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:27,033 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:27,033 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:27,033 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:27,033 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:27,033 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:27,043 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:27,043 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:27,043 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:27,043 | 1640 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:27,043 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:27,363 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:27,363 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:27,363 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:27,363 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:27,363 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:27,363 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:27,363 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\xd0c\x8e\xc2\x8a\xa2\xcf\x01\xd0c\x8e\xc2\x8a\xa2\xcf\x01\xd0c\x8e\xc2\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:27,373 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:27,373 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:27,373 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:27,373 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:27,373 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:27,373 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:27,383 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x010X\xc2\xc2\x8a\xa2\xcf\x01\xd0c\x8e\xc2\x8a\xa2\xcf\x01\xd0c\x8e\xc2\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:27,383 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:27,383 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:27,383 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:27,383 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:27,383 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:27,383 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:27,383 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01`\xdf\xc3\xc2\x8a\xa2\xcf\x01\xd0c\x8e\xc2\x8a\xa2\xcf\x01\xd0c\x8e\xc2\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:27,393 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:27,393 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:27,393 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:27,393 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:27,393 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:27,393 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:27,393 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \xa0\xb0\x1c\xbf\x8a\xa2\xcf\x01\x90f\xc5\xc2\x8a\xa2\xcf\x01\x90f\xc5\xc2\x8a\xa2\xcf\x01\x90f\xc5\xc2\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00\x11\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:27,413 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:27,413 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:27,413 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:27,413 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:27,413 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:27,413 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:27,413 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:27,423 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:27,423 | 1640 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:27,423 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:27,423 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:27,423 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:27,423 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:27,423 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:27,433 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:27,433 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:27,433 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\xf0t\xc8\xc2\x8a\xa2\xcf\x01\xf0t\xc8\xc2\x8a\xa2\xcf\x01\xf0t\xc8\xc2\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:27,433 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:27,433 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:27,433 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:27,433 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:27,433 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:27,433 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:27,433 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01P\x83\xcb\xc2\x8a\xa2\xcf\x01\xf0t\xc8\xc2\x8a\xa2\xcf\x01\xf0t\xc8\xc2\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:27,443 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:27,443 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:27,443 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:27,443 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:27,443 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:27,443 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:27,443 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => \xa0\xb0\x1c\xbf\x8a\xa2\xcf\x01\x80 \xcd\xc2\x8a\xa2\xcf\x01\x80 \xcd\xc2\x8a\xa2\xcf\x01\x80 \xcd\xc2\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:27,493 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:27,493 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:27,493 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:27,493 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:27,493 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002475a8 | |
| 09:18:27,493 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002475a8 | |
| 09:18:27,493 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002475a8 | |
| 09:18:27,493 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002475a8 | |
| 09:18:27,503 | 1640 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:27,503 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000046c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:27,513 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000374 FileInformation => \x00\xc0\x03\x00\x00\x00\x00\x00\x00\xc0\x03\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:18:27,513 | 1640 | RegOpenKeyExA |
Handle => 0x00000468 Registry => 0x80000002 SubKey => Software\Microsoft\Cryptography\OID |
SUCCESS | 0x00000000 | |
| 09:18:27,513 | 1640 | RegEnumKeyExA |
Index => 0 Handle => 0x00000468 Name => EncodingType 0 Class => |
SUCCESS | 0x00000000 | |
| 09:18:27,523 | 1640 | RegOpenKeyExA |
Handle => 0x0000046c Registry => 0x00000468 SubKey => EncodingType 0 |
SUCCESS | 0x00000000 | |
| 09:18:27,523 | 1640 | RegOpenKeyExA |
Handle => 0x00000470 Registry => 0x0000046c SubKey => CertDllOpenStoreProv |
SUCCESS | 0x00000000 | |
| 09:18:27,523 | 1640 | RegEnumKeyExA |
Index => 0 Handle => 0x00000470 Name => #16 Class => |
SUCCESS | 0x00000000 | |
| 09:18:27,523 | 1640 | RegOpenKeyExA |
Handle => 0x00000474 Registry => 0x00000470 SubKey => #16 |
SUCCESS | 0x00000000 | |
| 09:18:27,523 | 1640 | RegQueryInfoKeyW |
MaxClassLength => 0 MaxValueLength => 36 MaxValueNameLength => 8 ValueCount => 2 MaxSubKeyLength => 0 KeyHandle => 0x00000474 SubKeyCount => 0 Class => |
SUCCESS | 0x00000000 | |
| 09:18:27,523 | 1640 | RegEnumValueW |
Index => 0 Handle => 0x00000474 Data => c\x00r\x00y\x00p\x00t\x00n\x00e\x00t\x00.\x00d\x00l\x00l\x00\x00\x00 ValueName => Dll |
SUCCESS | 0x00000000 | |
| 09:18:27,523 | 1640 | RegEnumValueW |
Index => 1 Handle => 0x00000474 Data => L\x00d\x00a\x00p\x00P\x00r\x00o\x00v\x00O\x00p\x00e\x00n\x00S\x00t\x00o\x00r\x00e\x00\x00\x00 ValueName => FuncName |
SUCCESS | 0x00000000 | |
| 09:18:27,523 | 1640 | RegCloseKey |
Handle => 0x00000474 |
SUCCESS | 0x00000000 | |
| 09:18:27,523 | 1640 | RegEnumKeyExA |
Index => 1 Handle => 0x00000470 Name => Ldap Class => |
SUCCESS | 0x00000000 | |
| 09:18:27,523 | 1640 | RegOpenKeyExA |
Handle => 0x00000474 Registry => 0x00000470 SubKey => Ldap |
SUCCESS | 0x00000000 | |
| 09:18:27,523 | 1640 | RegQueryInfoKeyW |
MaxClassLength => 0 MaxValueLength => 36 MaxValueNameLength => 8 ValueCount => 2 MaxSubKeyLength => 0 KeyHandle => 0x00000474 SubKeyCount => 0 Class => |
SUCCESS | 0x00000000 | |
| 09:18:27,523 | 1640 | RegEnumValueW |
Index => 0 Handle => 0x00000474 Data => c\x00r\x00y\x00p\x00t\x00n\x00e\x00t\x00.\x00d\x00l\x00l\x00\x00\x00 ValueName => Dll |
SUCCESS | 0x00000000 | |
| 09:18:27,533 | 1640 | RegEnumValueW |
Index => 1 Handle => 0x00000474 Data => L\x00d\x00a\x00p\x00P\x00r\x00o\x00v\x00O\x00p\x00e\x00n\x00S\x00t\x00o\x00r\x00e\x00\x00\x00 ValueName => FuncName |
SUCCESS | 0x00000000 | |
| 09:18:27,533 | 1640 | RegCloseKey |
Handle => 0x00000474 |
SUCCESS | 0x00000000 | |
| 09:18:27,533 | 1640 | RegEnumKeyExA |
Index => 2 Handle => 0x00000470 Name => Ldap Class => |
FAILURE | 0x00000103 | |
| 09:18:27,533 | 1640 | RegCloseKey |
Handle => 0x00000470 |
SUCCESS | 0x00000000 | |
| 09:18:27,533 | 1640 | RegCloseKey |
Handle => 0x0000046c |
SUCCESS | 0x00000000 | |
| 09:18:27,533 | 1640 | RegEnumKeyExA |
Index => 1 Handle => 0x00000468 Name => EncodingType 1 Class => |
SUCCESS | 0x00000000 | |
| 09:18:27,533 | 1640 | RegOpenKeyExA |
Handle => 0x0000046c Registry => 0x00000468 SubKey => EncodingType 1 |
SUCCESS | 0x00000000 | |
| 09:18:27,533 | 1640 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x0000046c SubKey => CertDllOpenStoreProv |
FAILURE | 0x00000002 | |
| 09:18:27,533 | 1640 | RegCloseKey |
Handle => 0x0000046c |
SUCCESS | 0x00000000 | |
| 09:18:27,533 | 1640 | RegEnumKeyExA |
Index => 2 Handle => 0x00000468 Name => EncodingType 1 Class => |
FAILURE | 0x00000103 | |
| 09:18:27,533 | 1640 | RegCloseKey |
Handle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:27,543 | 1640 | RegOpenKeyExW |
Handle => 0x00000468 Registry => 0x80000003 SubKey => S-1-5-21-1935655697-1606980848-1060284298-1003 |
SUCCESS | 0x00000000 | |
| 09:18:27,543 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x00000468 SubKey => Software\Microsoft\SystemCertificates\MY\PhysicalStores |
FAILURE | 0x00000002 | |
| 09:18:27,543 | 1640 | RegCloseKey |
Handle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:27,543 | 1640 | RegOpenKeyExW |
Handle => 0x00000468 Registry => 0x80000003 SubKey => S-1-5-21-1935655697-1606980848-1060284298-1003 |
SUCCESS | 0x00000000 | |
| 09:18:27,543 | 1640 | RegCreateKeyExW |
Handle => 0x0000046c Access => 983103 Registry => 0x00000468 Class => SubKey => Software\Microsoft\SystemCertificates\MY |
SUCCESS | 0x00000000 | |
| 09:18:27,543 | 1640 | RegCloseKey |
Handle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:27,543 | 1640 | RegCloseKey |
Handle => 0x0000046c |
SUCCESS | 0x00000000 | |
| 09:18:27,543 | 1640 | LdrLoadDll |
Flags => 33289128 BaseAddress => 0x77c00000 FileName => VERSION.dll |
SUCCESS | 0x00000000 | |
| 09:18:27,543 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetFileVersionInfoSizeA FunctionAddress => 0x77c019ef ModuleHandle => 0x77c00000 |
SUCCESS | 0x00000000 | |
| 09:18:27,543 | 1640 | LdrGetDllHandle |
ModuleHandle => 0x769c0000 FileName => userenv.dll |
SUCCESS | 0x00000000 | |
| 09:18:27,543 | 1640 | LdrLoadDll |
Flags => 33289144 BaseAddress => 0x769c0000 FileName => userenv.dll |
SUCCESS | 0x00000000 | |
| 09:18:27,553 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetFileVersionInfoA FunctionAddress => 0x77c01a40 ModuleHandle => 0x77c00000 |
SUCCESS | 0x00000000 | |
| 09:18:27,553 | 1640 | LdrGetDllHandle |
ModuleHandle => 0x769c0000 FileName => userenv.dll |
SUCCESS | 0x00000000 | |
| 09:18:27,553 | 1640 | LdrLoadDll |
Flags => 33289128 BaseAddress => 0x769c0000 FileName => userenv.dll |
SUCCESS | 0x00000000 | |
| 09:18:27,553 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => VerQueryValueA FunctionAddress => 0x77c018aa ModuleHandle => 0x77c00000 |
SUCCESS | 0x00000000 | |
| 09:18:27,553 | 1640 | LdrLoadDll |
Flags => 33289572 BaseAddress => 0x769c0000 FileName => userenv.dll |
SUCCESS | 0x00000000 | |
| 09:18:27,553 | 1640 | LdrGetProcedureAddress |
Ordinal => 149 FunctionName => FunctionAddress => 0x769c1bc9 ModuleHandle => 0x769c0000 |
SUCCESS | 0x00000000 | |
| 09:18:27,553 | 1640 | RegOpenKeyExW |
Handle => 0x00000468 Registry => 0x80000003 SubKey => S-1-5-21-1935655697-1606980848-1060284298-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders |
SUCCESS | 0x00000000 | |
| 09:18:27,553 | 1640 | RegQueryValueExW |
Handle => 0x00000468 Data => %\x00U\x00S\x00E\x00R\x00P\x00R\x00O\x00F\x00I\x00L\x00E\x00%\x00\\x00A\x00p\x00p\x00l\x00i\x00c\x00a\x00t\x00i\x00o\x00n\x00 \x00D\x00a\x00t\x00a\x00\x00\x00 ValueName => AppData |
SUCCESS | 0x00000000 | |
| 09:18:27,553 | 1640 | RegOpenKeyExW |
Handle => 0x00000470 Registry => 0x80000002 SubKey => Software\Microsoft\Windows NT\CurrentVersion\ProfileList |
SUCCESS | 0x00000000 | |
| 09:18:27,553 | 1640 | RegQueryValueExW |
Handle => 0x00000470 Data => %\x00S\x00y\x00s\x00t\x00e\x00m\x00D\x00r\x00i\x00v\x00e\x00%\x00\\x00D\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00s\x00 \x00a\x00n\x00d\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\x00\x00 ValueName => ProfilesDirectory |
SUCCESS | 0x00000000 | |
| 09:18:27,553 | 1640 | RegCloseKey |
Handle => 0x00000470 |
SUCCESS | 0x00000000 | |
| 09:18:27,553 | 1640 | RegOpenKeyExW |
Handle => 0x00000470 Registry => 0x80000002 SubKey => Software\Microsoft\Windows NT\CurrentVersion\ProfileList |
SUCCESS | 0x00000000 | |
| 09:18:27,563 | 1640 | RegQueryValueExW |
Handle => 0x00000470 Data => A\x00l\x00l\x00 \x00U\x00s\x00e\x00r\x00s\x00\x00\x00 ValueName => AllUsersProfile |
SUCCESS | 0x00000000 | |
| 09:18:27,563 | 1640 | RegCloseKey |
Handle => 0x00000470 |
SUCCESS | 0x00000000 | |
| 09:18:27,563 | 1640 | RegOpenKeyExW |
Handle => 0x00000470 Registry => 0x80000002 SubKey => System\CurrentControlSet\Control\Session Manager\Environment |
SUCCESS | 0x00000000 | |
| 09:18:27,563 | 1640 | RegQueryInfoKeyW |
MaxClassLength => 0 MaxValueLength => 124 MaxValueNameLength => 22 ValueCount => 13 MaxSubKeyLength => 0 KeyHandle => 0x00000470 SubKeyCount => 0 Class => |
SUCCESS | 0x00000000 | |
| 09:18:27,563 | 1640 | RegEnumValueW |
Index => 0 Handle => 0x00000470 Data => %\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00\\x00s\x00y\x00s\x00t\x00e\x00m\x003\x002\x00\\x00c\x00m\x00d\x00.\x00e\x00x\x00e\x00\x00\x00 ValueName => ComSpec |
SUCCESS | 0x00000000 | |
| 09:18:27,563 | 1640 | RegEnumValueW |
Index => 1 Handle => 0x00000470 Data => %\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00\\x00s\x00y\x00s\x00t\x00e\x00m\x003\x002\x00;\x00%\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00;\x00%\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00\\x00S\x00y\x00s\x00t\x00e\x00m\x003\x002\x00\\x00W\x00b\x00e\x00m\x00\x00\x00 ValueName => Path |
SUCCESS | 0x00000000 | |
| 09:18:27,563 | 1640 | RegEnumValueW |
Index => 2 Handle => 0x00000470 Data => %\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00\x00\x00 ValueName => windir |
SUCCESS | 0x00000000 | |
| 09:18:27,563 | 1640 | RegEnumValueW |
Index => 3 Handle => 0x00000470 Data => N\x00O\x00\x00\x00 ValueName => FP_NO_HOST_CHECK |
SUCCESS | 0x00000000 | |
| 09:18:27,563 | 1640 | RegEnumValueW |
Index => 4 Handle => 0x00000470 Data => W\x00i\x00n\x00d\x00o\x00w\x00s\x00_\x00N\x00T\x00\x00\x00 ValueName => OS |
SUCCESS | 0x00000000 | |
| 09:18:27,563 | 1640 | RegEnumValueW |
Index => 5 Handle => 0x00000470 Data => x\x008\x006\x00\x00\x00 ValueName => PROCESSOR_ARCHITECTURE |
SUCCESS | 0x00000000 | |
| 09:18:27,563 | 1640 | RegEnumValueW |
Index => 6 Handle => 0x00000470 Data => 1\x005\x00\x00\x00 ValueName => PROCESSOR_LEVEL |
SUCCESS | 0x00000000 | |
| 09:18:27,573 | 1640 | RegEnumValueW |
Index => 7 Handle => 0x00000470 Data => x\x008\x006\x00 \x00F\x00a\x00m\x00i\x00l\x00y\x00 \x001\x005\x00 \x00M\x00o\x00d\x00e\x00l\x00 \x001\x000\x007\x00 \x00S\x00t\x00e\x00p\x00p\x00i\x00n\x00g\x00 \x001\x00,\x00 \x00A\x00u\x00t\x00h\x00e\x00n\x00t\x00i\x00c\x00A\x00M\x00D\x00\x00\x00 ValueName => PROCESSOR_IDENTIFIER |
SUCCESS | 0x00000000 | |
| 09:18:27,573 | 1640 | RegEnumValueW |
Index => 8 Handle => 0x00000470 Data => 6\x00b\x000\x001\x00\x00\x00 ValueName => PROCESSOR_REVISION |
SUCCESS | 0x00000000 | |
| 09:18:27,573 | 1640 | RegEnumValueW |
Index => 9 Handle => 0x00000470 Data => 1\x00\x00\x00 ValueName => NUMBER_OF_PROCESSORS |
SUCCESS | 0x00000000 | |
| 09:18:27,573 | 1640 | RegEnumValueW |
Index => 10 Handle => 0x00000470 Data => .\x00C\x00O\x00M\x00;\x00.\x00E\x00X\x00E\x00;\x00.\x00B\x00A\x00T\x00;\x00.\x00C\x00M\x00D\x00;\x00.\x00V\x00B\x00S\x00;\x00.\x00V\x00B\x00E\x00;\x00.\x00J\x00S\x00;\x00.\x00J\x00S\x00E\x00;\x00.\x00W\x00S\x00F\x00;\x00.\x00W\x00S\x00H\x00\x00\x00 ValueName => PATHEXT |
SUCCESS | 0x00000000 | |
| 09:18:27,573 | 1640 | RegEnumValueW |
Index => 11 Handle => 0x00000470 Data => %\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00\\x00T\x00E\x00M\x00P\x00\x00\x00 ValueName => TEMP |
SUCCESS | 0x00000000 | |
| 09:18:27,573 | 1640 | RegEnumValueW |
Index => 12 Handle => 0x00000470 Data => %\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00\\x00T\x00E\x00M\x00P\x00\x00\x00 ValueName => TMP |
SUCCESS | 0x00000000 | |
| 09:18:27,573 | 1640 | RegEnumValueW |
Index => 0 Handle => 0x00000470 Data => %\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00\\x00s\x00y\x00s\x00t\x00e\x00m\x003\x002\x00\\x00c\x00m\x00d\x00.\x00e\x00x\x00e\x00\x00\x00 ValueName => ComSpec |
SUCCESS | 0x00000000 | |
| 09:18:27,573 | 1640 | RegEnumValueW |
Index => 1 Handle => 0x00000470 Data => %\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00\\x00s\x00y\x00s\x00t\x00e\x00m\x003\x002\x00;\x00%\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00;\x00%\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00\\x00S\x00y\x00s\x00t\x00e\x00m\x003\x002\x00\\x00W\x00b\x00e\x00m\x00\x00\x00 ValueName => Path |
SUCCESS | 0x00000000 | |
| 09:18:27,573 | 1640 | RegEnumValueW |
Index => 2 Handle => 0x00000470 Data => %\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00\x00\x00 ValueName => windir |
SUCCESS | 0x00000000 | |
| 09:18:27,573 | 1640 | RegEnumValueW |
Index => 3 Handle => 0x00000470 Data => N\x00O\x00\x00\x00 ValueName => FP_NO_HOST_CHECK |
SUCCESS | 0x00000000 | |
| 09:18:27,573 | 1640 | RegEnumValueW |
Index => 4 Handle => 0x00000470 Data => W\x00i\x00n\x00d\x00o\x00w\x00s\x00_\x00N\x00T\x00\x00\x00 ValueName => OS |
SUCCESS | 0x00000000 | |
| 09:18:27,583 | 1640 | RegEnumValueW |
Index => 5 Handle => 0x00000470 Data => x\x008\x006\x00\x00\x00 ValueName => PROCESSOR_ARCHITECTURE |
SUCCESS | 0x00000000 | |
| 09:18:27,583 | 1640 | RegEnumValueW |
Index => 6 Handle => 0x00000470 Data => 1\x005\x00\x00\x00 ValueName => PROCESSOR_LEVEL |
SUCCESS | 0x00000000 | |
| 09:18:27,583 | 1640 | RegEnumValueW |
Index => 7 Handle => 0x00000470 Data => x\x008\x006\x00 \x00F\x00a\x00m\x00i\x00l\x00y\x00 \x001\x005\x00 \x00M\x00o\x00d\x00e\x00l\x00 \x001\x000\x007\x00 \x00S\x00t\x00e\x00p\x00p\x00i\x00n\x00g\x00 \x001\x00,\x00 \x00A\x00u\x00t\x00h\x00e\x00n\x00t\x00i\x00c\x00A\x00M\x00D\x00\x00\x00 ValueName => PROCESSOR_IDENTIFIER |
SUCCESS | 0x00000000 | |
| 09:18:27,583 | 1640 | RegEnumValueW |
Index => 8 Handle => 0x00000470 Data => 6\x00b\x000\x001\x00\x00\x00 ValueName => PROCESSOR_REVISION |
SUCCESS | 0x00000000 | |
| 09:18:27,583 | 1640 | RegEnumValueW |
Index => 9 Handle => 0x00000470 Data => 1\x00\x00\x00 ValueName => NUMBER_OF_PROCESSORS |
SUCCESS | 0x00000000 | |
| 09:18:27,583 | 1640 | RegEnumValueW |
Index => 10 Handle => 0x00000470 Data => .\x00C\x00O\x00M\x00;\x00.\x00E\x00X\x00E\x00;\x00.\x00B\x00A\x00T\x00;\x00.\x00C\x00M\x00D\x00;\x00.\x00V\x00B\x00S\x00;\x00.\x00V\x00B\x00E\x00;\x00.\x00J\x00S\x00;\x00.\x00J\x00S\x00E\x00;\x00.\x00W\x00S\x00F\x00;\x00.\x00W\x00S\x00H\x00\x00\x00 ValueName => PATHEXT |
SUCCESS | 0x00000000 | |
| 09:18:27,583 | 1640 | RegEnumValueW |
Index => 11 Handle => 0x00000470 Data => %\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00\\x00T\x00E\x00M\x00P\x00\x00\x00 ValueName => TEMP |
SUCCESS | 0x00000000 | |
| 09:18:27,583 | 1640 | RegEnumValueW |
Index => 12 Handle => 0x00000470 Data => %\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00\\x00T\x00E\x00M\x00P\x00\x00\x00 ValueName => TMP |
SUCCESS | 0x00000000 | |
| 09:18:27,583 | 1640 | RegCloseKey |
Handle => 0x00000470 |
SUCCESS | 0x00000000 | |
| 09:18:27,583 | 1640 | NtOpenKey |
DesiredAccess => 131097 KeyHandle => 0x00000470 ObjectAttributes => \Registry\Machine\System\CurrentControlSet\Control\ComputerName |
SUCCESS | 0x00000000 | |
| 09:18:27,593 | 1640 | NtOpenKey |
DesiredAccess => 131097 KeyHandle => 0x00000474 ObjectAttributes => ActiveComputerName |
SUCCESS | 0x00000000 | |
| 09:18:27,593 | 1640 | NtQueryValueKey |
Information => T\x00U\x00R\x00B\x00O\x00P\x00C\x00\x00\x00 KeyHandle => 0x00000474 ValueName => ComputerName Type => 1 |
SUCCESS | 0x00000000 | |
| 09:18:27,593 | 1640 | RegOpenKeyExW |
Handle => 0x00000470 Registry => 0x80000002 SubKey => Software\Microsoft\Windows NT\CurrentVersion\ProfileList |
SUCCESS | 0x00000000 | |
| 09:18:27,593 | 1640 | RegQueryValueExW |
Handle => 0x00000470 Data => %\x00S\x00y\x00s\x00t\x00e\x00m\x00D\x00r\x00i\x00v\x00e\x00%\x00\\x00D\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00s\x00 \x00a\x00n\x00d\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\x00\x00 ValueName => ProfilesDirectory |
SUCCESS | 0x00000000 | |
| 09:18:27,593 | 1640 | RegCloseKey |
Handle => 0x00000470 |
SUCCESS | 0x00000000 | |
| 09:18:27,593 | 1640 | RegOpenKeyExW |
Handle => 0x00000470 Registry => 0x80000002 SubKey => Software\Microsoft\Windows NT\CurrentVersion\ProfileList |
SUCCESS | 0x00000000 | |
| 09:18:27,593 | 1640 | RegQueryValueExW |
Handle => 0x00000470 Data => D\x00e\x00f\x00a\x00u\x00l\x00t\x00 \x00U\x00s\x00e\x00r\x00\x00\x00 ValueName => DefaultUserProfile |
SUCCESS | 0x00000000 | |
| 09:18:27,593 | 1640 | RegCloseKey |
Handle => 0x00000470 |
SUCCESS | 0x00000000 | |
| 09:18:27,593 | 1640 | RegOpenKeyExW |
Handle => 0x00000470 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion |
SUCCESS | 0x00000000 | |
| 09:18:27,593 | 1640 | RegQueryValueExW |
Handle => 0x00000470 Data => C\x00:\x00\\x00P\x00r\x00o\x00g\x00r\x00a\x00m\x00 \x00F\x00i\x00l\x00e\x00s\x00\x00\x00 ValueName => ProgramFilesDir |
SUCCESS | 0x00000000 | |
| 09:18:27,593 | 1640 | RegQueryValueExW |
Handle => 0x00000470 Data => C\x00:\x00\\x00P\x00r\x00o\x00g\x00r\x00a\x00m\x00 \x00F\x00i\x00l\x00e\x00s\x00\\x00C\x00o\x00m\x00m\x00o\x00n\x00 \x00F\x00i\x00l\x00e\x00s\x00\x00\x00 ValueName => CommonFilesDir |
SUCCESS | 0x00000000 | |
| 09:18:27,603 | 1640 | RegCloseKey |
Handle => 0x00000470 |
SUCCESS | 0x00000000 | |
| 09:18:27,603 | 1640 | RegOpenKeyExW |
Handle => 0x00000470 Registry => 0x80000003 SubKey => S-1-5-21-1935655697-1606980848-1060284298-1003 |
SUCCESS | 0x00000000 | |
| 09:18:27,603 | 1640 | LdrLoadDll |
Flags => 33288824 BaseAddress => 0x77fe0000 FileName => secur32.dll |
SUCCESS | 0x00000000 | |
| 09:18:27,603 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetUserNameExW FunctionAddress => 0x77fe1c70 ModuleHandle => 0x77fe0000 |
SUCCESS | 0x00000000 | |
| 09:18:27,603 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetComputerObjectNameW FunctionAddress => 0x77febed4 ModuleHandle => 0x77fe0000 |
SUCCESS | 0x00000000 | |
| 09:18:27,603 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => TranslateNameW FunctionAddress => 0x77fec06b ModuleHandle => 0x77fe0000 |
SUCCESS | 0x00000000 | |
| 09:18:27,603 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => AcceptSecurityContext FunctionAddress => 0x77fe5351 ModuleHandle => 0x77fe0000 |
SUCCESS | 0x00000000 | |
| 09:18:27,603 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => AcquireCredentialsHandleW FunctionAddress => 0x77fe3103 ModuleHandle => 0x77fe0000 |
SUCCESS | 0x00000000 | |
| 09:18:27,603 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => DeleteSecurityContext FunctionAddress => 0x77fe2d0d ModuleHandle => 0x77fe0000 |
SUCCESS | 0x00000000 | |
| 09:18:27,603 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => FreeContextBuffer FunctionAddress => 0x77fe287e ModuleHandle => 0x77fe0000 |
SUCCESS | 0x00000000 | |
| 09:18:27,603 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => FreeCredentialsHandle FunctionAddress => 0x77fe2b91 ModuleHandle => 0x77fe0000 |
SUCCESS | 0x00000000 | |
| 09:18:27,613 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => InitializeSecurityContextW FunctionAddress => 0x77fe5bd3 ModuleHandle => 0x77fe0000 |
SUCCESS | 0x00000000 | |
| 09:18:27,613 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => QuerySecurityContextToken FunctionAddress => 0x77fea43b ModuleHandle => 0x77fe0000 |
SUCCESS | 0x00000000 | |
| 09:18:27,613 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => QuerySecurityPackageInfoW FunctionAddress => 0x77fe386c ModuleHandle => 0x77fe0000 |
SUCCESS | 0x00000000 | |
| 09:18:27,613 | 1640 | RegOpenKeyExW |
Handle => 0x00000474 Registry => 0x80000002 SubKey => Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1935655697-1606980848-1060284298-1003 |
SUCCESS | 0x00000000 | |
| 09:18:27,613 | 1640 | RegQueryValueExW |
Handle => 0x00000474 Data => %\x00S\x00y\x00s\x00t\x00e\x00m\x00D\x00r\x00i\x00v\x00e\x00%\x00\\x00D\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00s\x00 \x00a\x00n\x00d\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00D\x00W\x00\x00\x00 ValueName => ProfileImagePath |
SUCCESS | 0x00000000 | |
| 09:18:27,613 | 1640 | RegCloseKey |
Handle => 0x00000474 |
SUCCESS | 0x00000000 | |
| 09:18:27,613 | 1640 | RegCreateKeyExW |
Handle => 0x00000474 Access => 131103 Registry => 0x00000470 Class => SubKey => Software\Microsoft\Windows NT\CurrentVersion\Winlogon |
SUCCESS | 0x00000000 | |
| 09:18:27,613 | 1640 | RegQueryValueExW |
Handle => 0x00000474 Data => 1\x00\x00\x00 ValueName => ParseAutoexec |
SUCCESS | 0x00000000 | |
| 09:18:27,613 | 1640 | RegCloseKey |
Handle => 0x00000474 |
SUCCESS | 0x00000000 | |
| 09:18:27,623 | 1640 | NtCreateFile |
ShareAccess => 1 FileName => c:\autoexec.bat DesiredAccess => 0x80100080 CreateDisposition => 1 FileHandle => 0x00000474 |
SUCCESS | 0x00000000 | |
| 09:18:27,623 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000474 FileInformation => \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:18:27,623 | 1640 | NtReadFile |
Buffer => FileHandle => 0x00000474 |
SUCCESS | 0x00000000 | |
| 09:18:27,623 | 1640 | RegOpenKeyExW |
Handle => 0x00000474 Registry => 0x00000470 SubKey => Environment |
SUCCESS | 0x00000000 | |
| 09:18:27,623 | 1640 | RegEnumValueW |
Index => 0 Handle => 0x00000474 Data => %\x00U\x00S\x00E\x00R\x00P\x00R\x00O\x00F\x00I\x00L\x00E\x00%\x00\\x00L\x00o\x00c\x00a\x00l\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00e\x00m\x00p\x00\x00\x00 ValueName => TEMP |
SUCCESS | 0x00000000 | |
| 09:18:27,623 | 1640 | RegEnumValueW |
Index => 1 Handle => 0x00000474 Data => %\x00U\x00S\x00E\x00R\x00P\x00R\x00O\x00F\x00I\x00L\x00E\x00%\x00\\x00L\x00o\x00c\x00a\x00l\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00e\x00m\x00p\x00\x00\x00 ValueName => TMP |
SUCCESS | 0x00000000 | |
| 09:18:27,623 | 1640 | RegEnumValueW |
Index => 2 Handle => 0x00000474 DataLength => 4096 ValueName => TMP Type => 33288460 |
FAILURE | 0x00000103 | |
| 09:18:27,623 | 1640 | RegEnumValueW |
Index => 0 Handle => 0x00000474 Data => %\x00U\x00S\x00E\x00R\x00P\x00R\x00O\x00F\x00I\x00L\x00E\x00%\x00\\x00L\x00o\x00c\x00a\x00l\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00e\x00m\x00p\x00\x00\x00 ValueName => TEMP |
SUCCESS | 0x00000000 | |
| 09:18:27,623 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings |
SUCCESS | 0x00247618 | |
| 09:18:27,633 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings |
SUCCESS | 0x00247618 | |
| 09:18:27,633 | 1640 | RegEnumValueW |
Index => 1 Handle => 0x00000474 Data => %\x00U\x00S\x00E\x00R\x00P\x00R\x00O\x00F\x00I\x00L\x00E\x00%\x00\\x00L\x00o\x00c\x00a\x00l\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00e\x00m\x00p\x00\x00\x00 ValueName => TMP |
SUCCESS | 0x00000000 | |
| 09:18:27,633 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings |
SUCCESS | 0x00247618 | |
| 09:18:27,633 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings |
SUCCESS | 0x00247618 | |
| 09:18:27,633 | 1640 | RegEnumValueW |
Index => 2 Handle => 0x00000474 DataLength => 4096 ValueName => TMP Type => 33288460 |
FAILURE | 0x00000103 | |
| 09:18:27,633 | 1640 | RegCloseKey |
Handle => 0x00000474 |
SUCCESS | 0x00000000 | |
| 09:18:27,633 | 1640 | RegOpenKeyExW |
Handle => 0x00000474 Registry => 0x00000470 SubKey => Volatile Environment |
SUCCESS | 0x00000000 | |
| 09:18:27,633 | 1640 | RegEnumValueW |
Index => 0 Handle => 0x00000474 Data => \\x00\\x00T\x00U\x00R\x00B\x00O\x00P\x00C\x00\x00\x00 ValueName => LOGONSERVER |
SUCCESS | 0x00000000 | |
| 09:18:27,633 | 1640 | RegEnumValueW |
Index => 1 Handle => 0x00000474 Data => C\x00o\x00n\x00s\x00o\x00l\x00e\x00\x00\x00 ValueName => CLIENTNAME |
SUCCESS | 0x00000000 | |
| 09:18:27,633 | 1640 | RegEnumValueW |
Index => 2 Handle => 0x00000474 Data => C\x00o\x00n\x00s\x00o\x00l\x00e\x00\x00\x00 ValueName => SESSIONNAME |
SUCCESS | 0x00000000 | |
| 09:18:27,643 | 1640 | RegEnumValueW |
Index => 3 Handle => 0x00000474 Data => C\x00:\x00\\x00D\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00s\x00 \x00a\x00n\x00d\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00D\x00W\x00\\x00A\x00p\x00p\x00l\x00i\x00c\x00a\x00t\x00i\x00o\x00n\x00 \x00D\x00a\x00t\x00a\x00\x00\x00 ValueName => APPDATA |
SUCCESS | 0x00000000 | |
| 09:18:27,643 | 1640 | RegEnumValueW |
Index => 4 Handle => 0x00000474 Data => C\x00:\x00\x00\x00 ValueName => HOMEDRIVE |
SUCCESS | 0x00000000 | |
| 09:18:27,643 | 1640 | RegEnumValueW |
Index => 5 Handle => 0x00000474 Data => \x00\x00 ValueName => HOMESHARE |
SUCCESS | 0x00000000 | |
| 09:18:27,643 | 1640 | RegEnumValueW |
Index => 6 Handle => 0x00000474 Data => \\x00D\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00s\x00 \x00a\x00n\x00d\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00D\x00W\x00\x00\x00 ValueName => HOMEPATH |
SUCCESS | 0x00000000 | |
| 09:18:27,643 | 1640 | RegEnumValueW |
Index => 7 Handle => 0x00000474 DataLength => 4096 ValueName => HOMEPATH Type => 33288460 |
FAILURE | 0x00000103 | |
| 09:18:27,643 | 1640 | RegEnumValueW |
Index => 0 Handle => 0x00000474 Data => \\x00\\x00T\x00U\x00R\x00B\x00O\x00P\x00C\x00\x00\x00 ValueName => LOGONSERVER |
SUCCESS | 0x00000000 | |
| 09:18:27,643 | 1640 | RegEnumValueW |
Index => 1 Handle => 0x00000474 Data => C\x00o\x00n\x00s\x00o\x00l\x00e\x00\x00\x00 ValueName => CLIENTNAME |
SUCCESS | 0x00000000 | |
| 09:18:27,643 | 1640 | RegEnumValueW |
Index => 2 Handle => 0x00000474 Data => C\x00o\x00n\x00s\x00o\x00l\x00e\x00\x00\x00 ValueName => SESSIONNAME |
SUCCESS | 0x00000000 | |
| 09:18:27,643 | 1640 | RegEnumValueW |
Index => 3 Handle => 0x00000474 Data => C\x00:\x00\\x00D\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00s\x00 \x00a\x00n\x00d\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00D\x00W\x00\\x00A\x00p\x00p\x00l\x00i\x00c\x00a\x00t\x00i\x00o\x00n\x00 \x00D\x00a\x00t\x00a\x00\x00\x00 ValueName => APPDATA |
SUCCESS | 0x00000000 | |
| 09:18:27,643 | 1640 | RegEnumValueW |
Index => 4 Handle => 0x00000474 Data => C\x00:\x00\x00\x00 ValueName => HOMEDRIVE |
SUCCESS | 0x00000000 | |
| 09:18:27,643 | 1640 | RegEnumValueW |
Index => 5 Handle => 0x00000474 Data => \x00\x00 ValueName => HOMESHARE |
SUCCESS | 0x00000000 | |
| 09:18:27,643 | 1640 | RegEnumValueW |
Index => 6 Handle => 0x00000474 Data => \\x00D\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00s\x00 \x00a\x00n\x00d\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00D\x00W\x00\x00\x00 ValueName => HOMEPATH |
SUCCESS | 0x00000000 | |
| 09:18:27,653 | 1640 | RegEnumValueW |
Index => 7 Handle => 0x00000474 DataLength => 4096 ValueName => HOMEPATH Type => 33288460 |
FAILURE | 0x00000103 | |
| 09:18:27,653 | 1640 | RegCloseKey |
Handle => 0x00000474 |
SUCCESS | 0x00000000 | |
| 09:18:27,653 | 1640 | RegCloseKey |
Handle => 0x00000470 |
SUCCESS | 0x00000000 | |
| 09:18:27,653 | 1640 | NtFreeVirtualMemory |
FreeType => 0x00008000 ProcessHandle => 0xffffffff RegionSize => 0x00001000 BaseAddress => 0x02af0000 |
SUCCESS | 0x00000000 | |
| 09:18:27,653 | 1640 | RegCloseKey |
Handle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:27,653 | 1640 | RegOpenKeyExW |
Handle => 0x0000046c Registry => 0x80000003 SubKey => S-1-5-21-1935655697-1606980848-1060284298-1003 |
SUCCESS | 0x00000000 | |
| 09:18:27,653 | 1640 | RegOpenKeyExW |
Handle => 0x00000468 Registry => 0x0000046c SubKey => Software\Microsoft\SystemCertificates\MY |
SUCCESS | 0x00000000 | |
| 09:18:27,653 | 1640 | RegCloseKey |
Handle => 0x0000046c |
SUCCESS | 0x00000000 | |
| 09:18:27,653 | 1640 | RegOpenKeyExW |
Handle => 0x0000046c Registry => 0x00000468 SubKey => |
SUCCESS | 0x00000000 | |
| 09:18:27,653 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x0000046c SubKey => Certificates |
FAILURE | 0x00000002 | |
| 09:18:27,653 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Microsoft\SystemCertificates\My\Certificates\* |
SUCCESS | 0x00247618 | |
| 09:18:27,663 | 1640 | NtQueryDirectoryFile |
FileName => FileHandle => 0x00000470 FileInformation => \x00\x00\x00\x00\x00\x00\x00\x00p\x03]\xb9\xd5I\xcd\x01p\xf7\xddf\xe8\x91\xcf\x01`\xb0M2oI\xcd\x01PKl\xb9\xd5I\xcd\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x14\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00.\x00.\x00 |
SUCCESS | 0x00000000 | |
| 09:18:27,663 | 1640 | NtQueryDirectoryFile |
FileName => FileHandle => 0x00000470 FileInformation => |
FAILURE | 2147483654 | |
| 09:18:27,663 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x0000046c SubKey => CRLs |
FAILURE | 0x00000002 | |
| 09:18:27,663 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Microsoft\SystemCertificates\My\CRLs\* |
SUCCESS | 0x00247618 | |
| 09:18:27,663 | 1640 | NtQueryDirectoryFile |
FileName => FileHandle => 0x00000470 FileInformation => \x00\x00\x00\x00\x00\x00\x00\x00p\x03]\xb9\xd5I\xcd\x01p\xf7\xddf\xe8\x91\xcf\x01`\xb0M2oI\xcd\x01PKl\xb9\xd5I\xcd\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x14\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00.\x00.\x00 |
SUCCESS | 0x00000000 | |
| 09:18:27,663 | 1640 | NtQueryDirectoryFile |
FileName => FileHandle => 0x00000470 FileInformation => |
FAILURE | 2147483654 | |
| 09:18:27,663 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x0000046c SubKey => CTLs |
FAILURE | 0x00000002 | |
| 09:18:27,663 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Microsoft\SystemCertificates\My\CTLs\* |
SUCCESS | 0x00247618 | |
| 09:18:27,663 | 1640 | NtQueryDirectoryFile |
FileName => FileHandle => 0x00000470 FileInformation => \x00\x00\x00\x00\x00\x00\x00\x00p\x03]\xb9\xd5I\xcd\x01p\xf7\xddf\xe8\x91\xcf\x01`\xb0M2oI\xcd\x01PKl\xb9\xd5I\xcd\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x14\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00.\x00.\x00 |
SUCCESS | 0x00000000 | |
| 09:18:27,663 | 1640 | NtQueryDirectoryFile |
FileName => FileHandle => 0x00000470 FileInformation => |
FAILURE | 2147483654 | |
| 09:18:27,663 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x0000046c SubKey => Keys |
FAILURE | 0x00000002 | |
| 09:18:27,663 | 1640 | RegCloseKey |
Handle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:18:27,673 | 1640 | LdrLoadDll |
Flags => 33290528 BaseAddress => 0x76c30000 FileName => wintrust.dll |
SUCCESS | 0x00000000 | |
| 09:18:27,673 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => WinVerifyTrust FunctionAddress => 0x76c32f2c ModuleHandle => 0x76c30000 |
SUCCESS | 0x00000000 | |
| 09:18:27,673 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => WTHelperProvDataFromStateData FunctionAddress => 0x76c416e6 ModuleHandle => 0x76c30000 |
SUCCESS | 0x00000000 | |
| 09:18:27,673 | 1640 | LdrLoadDll |
Flags => 33290412 BaseAddress => 0x77c00000 FileName => VERSION.dll |
SUCCESS | 0x00000000 | |
| 09:18:27,673 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetFileVersionInfoSizeA FunctionAddress => 0x77c019ef ModuleHandle => 0x77c00000 |
SUCCESS | 0x00000000 | |
| 09:18:27,673 | 1640 | LdrGetDllHandle |
ModuleHandle => 0x76c30000 FileName => C:\WINDOWS\system32\wintrust.dll |
SUCCESS | 0x00000000 | |
| 09:18:27,673 | 1640 | LdrLoadDll |
Flags => 33290456 BaseAddress => 0x76c30000 FileName => C:\WINDOWS\system32\wintrust.dll |
SUCCESS | 0x00000000 | |
| 09:18:27,673 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetFileVersionInfoA FunctionAddress => 0x77c01a40 ModuleHandle => 0x77c00000 |
SUCCESS | 0x00000000 | |
| 09:18:27,673 | 1640 | LdrGetDllHandle |
ModuleHandle => 0x76c30000 FileName => C:\WINDOWS\system32\wintrust.dll |
SUCCESS | 0x00000000 | |
| 09:18:27,673 | 1640 | LdrLoadDll |
Flags => 33288476 BaseAddress => 0x76c30000 FileName => C:\WINDOWS\system32\wintrust.dll |
SUCCESS | 0x00000000 | |
| 09:18:27,673 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => VerQueryValueA FunctionAddress => 0x77c018aa ModuleHandle => 0x77c00000 |
SUCCESS | 0x00000000 | |
| 09:18:27,684 | 1640 | LdrLoadDll |
Flags => 33290828 BaseAddress => 0x767f0000 FileName => schannel |
SUCCESS | 0x00000000 | |
| 09:18:27,684 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => InitSecurityInterfaceA FunctionAddress => 0x77fe6a3c ModuleHandle => 0x767f0000 |
SUCCESS | 0x00000000 | |
| 09:18:27,684 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => SslCrackCertificate FunctionAddress => 0x767f2e31 ModuleHandle => 0x767f0000 |
SUCCESS | 0x00000000 | |
| 09:18:27,684 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => SslFreeCertificate FunctionAddress => 0x767f2e0c ModuleHandle => 0x767f0000 |
SUCCESS | 0x00000000 | |
| 09:18:27,684 | 1640 | LdrGetDllHandle |
ModuleHandle => 0x77a80000 FileName => crypt32 |
SUCCESS | 0x00000000 | |
| 09:18:27,684 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CryptInstallDefaultContext FunctionAddress => 0x77abcb30 ModuleHandle => 0x77a80000 |
SUCCESS | 0x00000000 | |
| 09:18:27,684 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CryptUninstallDefaultContext FunctionAddress => 0x77abcc94 ModuleHandle => 0x77a80000 |
SUCCESS | 0x00000000 | |
| 09:18:27,684 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CertFindChainInStore FunctionAddress => 0x77ac0d1e ModuleHandle => 0x77a80000 |
SUCCESS | 0x00000000 | |
| 09:18:27,694 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CertFreeCertificateChain FunctionAddress => 0x77a9b041 ModuleHandle => 0x77a80000 |
SUCCESS | 0x00000000 | |
| 09:18:27,694 | 1640 | OpenSCManagerW |
MachineName => DatabaseName => DesiredAccess => 2147483648 |
SUCCESS | 0x00249f60 | |
| 09:18:27,694 | 1640 | OpenServiceW |
ServiceControlManager => 0x00249f60 ServiceName => RASMAN DesiredAccess => 4 |
SUCCESS | 0x00249f88 | |
| 09:18:27,694 | 1640 | RegQueryValueExA |
Handle => 0x00000354 DataLength => 4 ValueName => EnableAutodial Type => 852 |
FAILURE | 0x00000002 | |
| 09:18:27,704 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000374 FileInformation => \x00\xc0\x03\x00\x00\x00\x00\x00\x00\xc0\x03\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | 1 time |
| 09:18:27,704 | 1640 | LdrLoadDll |
Flags => 33291144 BaseAddress => 0x7e1e0000 FileName => urlmon.dll |
SUCCESS | 0x00000000 | |
| 09:18:27,704 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CoInternetCreateSecurityManager FunctionAddress => 0x7e1e30e7 ModuleHandle => 0x7e1e0000 |
SUCCESS | 0x00000000 | |
| 09:18:27,704 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CoInternetCreateZoneManager FunctionAddress => 0x7e1e9bd7 ModuleHandle => 0x7e1e0000 |
SUCCESS | 0x00000000 | |
| 09:18:27,704 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CoInternetIsFeatureEnabledForUrl FunctionAddress => 0x7e1ebb5e ModuleHandle => 0x7e1e0000 |
SUCCESS | 0x00000000 | |
| 09:18:27,704 | 1640 | RegOpenKeyExA |
Handle => 0x00000484 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ |
SUCCESS | 0x00000000 | |
| 09:18:27,704 | 1640 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ |
FAILURE | 0x00000002 | |
| 09:18:27,704 | 1640 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ |
FAILURE | 0x00000002 | |
| 09:18:27,714 | 1640 | RegOpenKeyExA |
Handle => 0x00000480 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ |
SUCCESS | 0x00000000 | |
| 09:18:27,714 | 1640 | RegOpenKeyExW |
Handle => 0x00000488 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:18:27,714 | 1640 | RegQueryValueExW |
Handle => 0x00000488 DataLength => 4 ValueName => Security_HKLM_only Type => 33289260 |
FAILURE | 0x00000002 | |
| 09:18:27,714 | 1640 | RegCloseKey |
Handle => 0x00000488 |
SUCCESS | 0x00000000 | |
| 09:18:27,714 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:18:27,714 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:18:27,714 | 1640 | RegOpenKeyExW |
Handle => 0x00000488 Registry => 0x80000002 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
SUCCESS | 0x00000000 | |
| 09:18:27,714 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:18:27,714 | 1640 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x00000488 SubKey => FEATURE_VALIDATE_URLHOSTNAME |
FAILURE | 0x00000002 | |
| 09:18:27,714 | 1640 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | 1 time |
| 09:18:27,724 | 1640 | RegCloseKey |
Handle => 0x00000488 |
SUCCESS | 0x00000000 | |
| 09:18:27,724 | 1640 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | |
| 09:18:27,724 | 1640 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x00000480 SubKey => Domains\adobe.com |
FAILURE | 0x00000002 | |
| 09:18:27,724 | 1640 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\adobe.com |
FAILURE | 0x00000002 | |
| 09:18:27,724 | 1640 | RegQueryValueExW |
Handle => 0x00000484 Data => 1 ValueName => IntranetName |
SUCCESS | 0x00000000 | |
| 09:18:27,724 | 1640 | RegQueryValueExW |
Handle => 0x00000484 Data => 1 ValueName => ProxyBypass |
SUCCESS | 0x00000000 | |
| 09:18:27,724 | 1640 | LdrLoadDll |
Flags => 33289340 BaseAddress => 0x771b0000 FileName => WININET.dll |
SUCCESS | 0x00000000 | |
| 09:18:27,724 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => IsHostInProxyBypassList FunctionAddress => 0x771d3350 ModuleHandle => 0x771b0000 |
SUCCESS | 0x00000000 | |
| 09:18:27,724 | 1640 | RegOpenKeyExA |
Handle => 0x00000488 Registry => 0x00000480 SubKey => ProtocolDefaults\ |
SUCCESS | 0x00000000 | |
| 09:18:27,724 | 1640 | RegQueryValueExW |
Handle => 0x00000488 Data => 3 ValueName => https |
SUCCESS | 0x00000000 | |
| 09:18:27,724 | 1640 | RegCloseKey |
Handle => 0x00000488 |
SUCCESS | 0x00000000 | |
| 09:18:27,724 | 1640 | RegOpenKeyExA |
Handle => 0x00000488 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 |
SUCCESS | 0x00000000 | |
| 09:18:27,734 | 1640 | RegQueryValueExW |
Handle => 0x00000488 Data => 1 ValueName => 1A10 |
SUCCESS | 0x00000000 | |
| 09:18:27,734 | 1640 | RegCloseKey |
Handle => 0x00000488 |
SUCCESS | 0x00000000 | |
| 09:18:27,734 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000374 FileInformation => \x00\xc0\x03\x00\x00\x00\x00\x00\x00\xc0\x03\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | 1 time |
| 09:18:27,744 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000384 FileInformation => \x00\x80\x00\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | 22 times |
| 09:18:27,754 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000374 FileInformation => \x00\xc0\x03\x00\x00\x00\x00\x00\x00\xc0\x03\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:18:27,754 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000384 FileInformation => \x00\x80\x00\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:18:27,764 | 1640 | NtCreateFile |
ShareAccess => 1 FileName => C:\Documents and Settings\TDW\Cookies\tdw@adobe[2].txt DesiredAccess => 0x80100080 CreateDisposition => 1 FileHandle => 0x00000488 |
SUCCESS | 0x00000000 | |
| 09:18:27,774 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000488 FileInformation => p\x00\x00\x00\x00\x00\x00\x00k\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:18:27,774 | 1640 | NtSetInformationFile |
FileHandle => 0x00000488 FileInformation => |
SUCCESS | 0x00000000 | |
| 09:18:27,774 | 1640 | NtReadFile |
Buffer => s_vi
[CS]v1|29D65EC68507B15F-4000010EE001FA5C[CE]
adobe.com/
1024
839917312
30527303
1280773376
30380519
*
FileHandle => 0x00000488 |
SUCCESS | 0x00000000 | |
| 09:18:27,774 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000374 FileInformation => \x00\xc0\x03\x00\x00\x00\x00\x00\x00\xc0\x03\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:18:27,774 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000384 FileInformation => \x00\x80\x00\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:18:27,794 | 1640 | RegQueryValueExA |
Handle => 0x00000354 DataLength => 4 ValueName => EnableAutodial Type => 852 |
FAILURE | 0x00000002 | |
| 09:18:27,794 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000374 FileInformation => \x00\xc0\x03\x00\x00\x00\x00\x00\x00\xc0\x03\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:18:27,794 | 1640 | getaddrinfo |
ServiceName => NodeName => service-updates.adobe.com |
FAILURE | 0x00002af9 | |
| 09:18:27,824 | 420 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:27,824 | 420 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:27,824 | 420 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:27,824 | 420 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:27,824 | 420 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000488 |
SUCCESS | 0x00000000 | |
| 09:18:27,824 | 420 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000048c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:27,824 | 420 | NtQueryInformationFile |
FileHandle => 0x00000488 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01p\xae\xd4\xc2\x8a\xa2\xcf\x01p\xae\xd4\xc2\x8a\xa2\xcf\x01p\xae\xd4\xc2\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:27,824 | 420 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:27,834 | 420 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:27,834 | 420 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:27,834 | 420 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:27,834 | 420 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000488 |
SUCCESS | 0x00000000 | |
| 09:18:27,834 | 420 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000048c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:27,834 | 420 | NtQueryInformationFile |
FileHandle => 0x00000488 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\xa0\x1b\x07\xc3\x8a\xa2\xcf\x01p\xae\xd4\xc2\x8a\xa2\xcf\x01p\xae\xd4\xc2\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:27,834 | 420 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:27,844 | 420 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:27,844 | 420 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:27,844 | 420 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:27,844 | 420 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000488 |
SUCCESS | 0x00000000 | |
| 09:18:27,844 | 420 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000048c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:27,844 | 420 | NtQueryInformationFile |
FileHandle => 0x00000488 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\xd0\xa2\x08\xc3\x8a\xa2\xcf\x01p\xae\xd4\xc2\x8a\xa2\xcf\x01p\xae\xd4\xc2\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:27,844 | 420 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:27,844 | 420 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:27,854 | 420 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:27,854 | 420 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:27,854 | 420 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000488 |
SUCCESS | 0x00000000 | |
| 09:18:27,854 | 420 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000048c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:27,854 | 420 | NtQueryInformationFile |
FileHandle => 0x00000488 FileInformation => \xa0\xb0\x1c\xbf\x8a\xa2\xcf\x010\xb1\x0b\xc3\x8a\xa2\xcf\x010\xb1\x0b\xc3\x8a\xa2\xcf\x010\xb1\x0b\xc3\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00\x13\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:27,864 | 420 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:27,864 | 420 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:27,864 | 420 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:27,864 | 420 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:27,864 | 420 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:27,864 | 420 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:27,864 | 420 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:27,874 | 420 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:27,874 | 420 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000488 |
SUCCESS | 0x00000000 | |
| 09:18:27,874 | 420 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000048c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:27,874 | 420 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:27,874 | 420 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:27,874 | 420 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:27,874 | 420 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:27,884 | 420 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000488 |
SUCCESS | 0x00000000 | |
| 09:18:27,884 | 420 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000048c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:27,884 | 420 | NtQueryInformationFile |
FileHandle => 0x00000488 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01`8 \xc3\x8a\xa2\xcf\x01`8 \xc3\x8a\xa2\xcf\x01`8 \xc3\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:27,884 | 420 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:27,884 | 420 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:27,884 | 420 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:27,884 | 420 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:27,884 | 420 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000488 |
SUCCESS | 0x00000000 | |
| 09:18:27,884 | 420 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000048c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:27,884 | 420 | NtQueryInformationFile |
FileHandle => 0x00000488 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\xc0F\x10\xc3\x8a\xa2\xcf\x01`8 \xc3\x8a\xa2\xcf\x01`8 \xc3\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:27,894 | 420 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:27,894 | 420 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:27,894 | 420 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:27,894 | 420 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:27,894 | 420 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000488 |
SUCCESS | 0x00000000 | |
| 09:18:27,894 | 420 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000048c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:27,894 | 420 | NtQueryInformationFile |
FileHandle => 0x00000488 FileInformation => \xa0\xb0\x1c\xbf\x8a\xa2\xcf\x01\xf0\xcd\x11\xc3\x8a\xa2\xcf\x01\xf0\xcd\x11\xc3\x8a\xa2\xcf\x01\xf0\xcd\x11\xc3\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00\x14\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:27,904 | 1640 | getaddrinfo |
ServiceName => NodeName => service-updates.adobe.com |
SUCCESS | 0x00000000 | |
| 09:18:27,904 | 1640 | socket |
type => 1 protocol => 6 af => 2 |
SUCCESS | 0x00000488 | |
| 09:18:27,914 | 1640 | ioctlsocket |
command => 2147772030 socket => 0x00000488 |
SUCCESS | 0x00000000 | |
| 09:18:27,914 | 1640 | bind |
ip => 0.0.0.0 socket => 0x00000488 port => 0 |
SUCCESS | 0x00000000 | |
| 09:18:27,914 | 1640 | NtDeviceIoControlFile |
InputBuffer => FileHandle => 0x00000488 OutputBuffer => \x01\x00\x00\x00\x01\x00\x00\x00\x0e\x00\x02\x00\x04\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:18:27,914 | 1640 | connect |
socket => 0x00000488 |
FAILURE | 4294967295 | |
| 09:18:27,914 | 520 | select |
socket => 0x00000002 |
SUCCESS | 0x00000001 | |
| 09:18:27,914 | 520 | WSARecv |
socket => 0x000003d0 |
SUCCESS | 0x00000000 | |
| 09:18:27,914 | 1640 | send |
buffer => ! socket => 0x000003d0 |
SUCCESS | 0x00000001 | |
| 09:18:27,924 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:27,924 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:27,924 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:27,924 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:27,924 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:27,924 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:27,924 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:27,934 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:27,934 | 1640 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:27,934 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:28,244 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:28,244 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:28,244 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:28,244 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:28,244 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:28,244 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:28,244 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000490 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\x80c\x16\xc3\x8a\xa2\xcf\x01\x80c\x16\xc3\x8a\xa2\xcf\x01\x80c\x16\xc3\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:28,244 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:28,254 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:28,254 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:28,254 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:28,254 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:28,254 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:28,254 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000490 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\x80IG\xc3\x8a\xa2\xcf\x01\x80c\x16\xc3\x8a\xa2\xcf\x01\x80c\x16\xc3\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:28,254 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:28,254 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:28,254 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:28,254 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:28,254 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:28,254 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:28,254 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000490 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\xb0\xd0H\xc3\x8a\xa2\xcf\x01\x80c\x16\xc3\x8a\xa2\xcf\x01\x80c\x16\xc3\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:28,254 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:28,254 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:28,254 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:28,264 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:28,264 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:28,264 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:28,264 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000490 FileInformation => \xa0\xb0\x1c\xbf\x8a\xa2\xcf\x01\xe0WJ\xc3\x8a\xa2\xcf\x01\xe0WJ\xc3\x8a\xa2\xcf\x01\xe0WJ\xc3\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00\x15\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:28,284 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:28,284 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:28,284 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:28,284 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:28,284 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:28,284 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:28,284 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:28,284 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:28,284 | 1640 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:28,284 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:28,284 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:28,284 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:28,284 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:28,284 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:28,284 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:28,284 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:28,284 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000490 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01@fM\xc3\x8a\xa2\xcf\x01@fM\xc3\x8a\xa2\xcf\x01@fM\xc3\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:28,284 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:28,284 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:28,284 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:28,284 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:28,284 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:28,284 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:28,284 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000490 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01@fM\xc3\x8a\xa2\xcf\x01@fM\xc3\x8a\xa2\xcf\x01@fM\xc3\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:28,294 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:28,294 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:28,294 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:28,294 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:28,294 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:28,294 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:28,294 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000490 FileInformation => \xa0\xb0\x1c\xbf\x8a\xa2\xcf\x01p\xedN\xc3\x8a\xa2\xcf\x01p\xedN\xc3\x8a\xa2\xcf\x01p\xedN\xc3\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00\x16\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:28,314 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:28,314 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:28,314 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:28,314 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:28,314 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:28,314 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:28,324 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:28,324 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:28,324 | 1640 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:28,324 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:28,645 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:28,645 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:28,645 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:28,645 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:28,645 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:28,645 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:28,645 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000490 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\xd0\xfbQ\xc3\x8a\xa2\xcf\x01\xd0\xfbQ\xc3\x8a\xa2\xcf\x01\xd0\xfbQ\xc3\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:28,655 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:28,655 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:28,655 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:28,655 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:28,665 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:28,665 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:28,665 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000490 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x010\xf0\x85\xc3\x8a\xa2\xcf\x01\xd0\xfbQ\xc3\x8a\xa2\xcf\x01\xd0\xfbQ\xc3\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:28,665 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:28,675 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:28,675 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:28,675 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:28,675 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:28,675 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:28,675 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000490 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01`w\x87\xc3\x8a\xa2\xcf\x01\xd0\xfbQ\xc3\x8a\xa2\xcf\x01\xd0\xfbQ\xc3\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:28,675 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:28,685 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:28,685 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:28,685 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:28,685 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:28,685 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:28,685 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000490 FileInformation => \xa0\xb0\x1c\xbf\x8a\xa2\xcf\x01\xc0\x85\x8a\xc3\x8a\xa2\xcf\x01\xc0\x85\x8a\xc3\x8a\xa2\xcf\x01\xc0\x85\x8a\xc3\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00\x17\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:28,705 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:28,705 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:28,705 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:28,705 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:28,705 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:28,715 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:28,715 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:28,715 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:28,715 | 1640 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:28,715 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:28,715 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:28,715 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:28,715 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:28,725 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:28,725 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:28,725 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:28,725 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000490 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01 \x94\x8d\xc3\x8a\xa2\xcf\x01 \x94\x8d\xc3\x8a\xa2\xcf\x01 \x94\x8d\xc3\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:28,725 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:28,725 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:28,725 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:28,725 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:28,725 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:28,735 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:28,735 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000490 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\x80\xa2\x90\xc3\x8a\xa2\xcf\x01 \x94\x8d\xc3\x8a\xa2\xcf\x01 \x94\x8d\xc3\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:28,735 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:28,735 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:28,735 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:28,735 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:28,735 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:28,745 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:28,745 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000490 FileInformation => \xa0\xb0\x1c\xbf\x8a\xa2\xcf\x01\xb0)\x92\xc3\x8a\xa2\xcf\x01\xb0)\x92\xc3\x8a\xa2\xcf\x01\xb0)\x92\xc3\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00\x18\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:28,785 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:28,785 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:28,785 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:28,785 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:28,785 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:28,785 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:28,785 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:28,795 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:28,795 | 1640 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:28,795 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:29,106 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:29,106 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:29,106 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:29,106 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:29,106 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:29,106 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:29,106 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000490 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\xa0\xcd\x99\xc3\x8a\xa2\xcf\x01\xa0\xcd\x99\xc3\x8a\xa2\xcf\x01\xa0\xcd\x99\xc3\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:29,116 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:29,126 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:29,126 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:29,126 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:29,126 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:29,126 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:29,126 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000490 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\xd0:\xcc\xc3\x8a\xa2\xcf\x01\xa0\xcd\x99\xc3\x8a\xa2\xcf\x01\xa0\xcd\x99\xc3\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:29,136 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:29,136 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:29,136 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:29,136 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:29,136 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:29,136 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:29,136 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000490 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x010I\xcf\xc3\x8a\xa2\xcf\x01\xa0\xcd\x99\xc3\x8a\xa2\xcf\x01\xa0\xcd\x99\xc3\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:29,136 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:29,136 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:29,146 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:29,146 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:29,146 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:29,146 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:29,146 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000490 FileInformation => \xa0\xb0\x1c\xbf\x8a\xa2\xcf\x01`\xd0\xd0\xc3\x8a\xa2\xcf\x01`\xd0\xd0\xc3\x8a\xa2\xcf\x01`\xd0\xd0\xc3\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00\x19\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:29,156 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:29,156 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:29,166 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:29,166 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:29,166 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:29,166 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:29,166 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:29,166 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:29,166 | 1640 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:29,166 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:29,166 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:29,176 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:29,176 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:29,176 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:29,176 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:29,176 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:29,176 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000490 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\x90W\xd2\xc3\x8a\xa2\xcf\x01\x90W\xd2\xc3\x8a\xa2\xcf\x01\x90W\xd2\xc3\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:29,176 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:29,176 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:29,186 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:29,186 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:29,186 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:29,186 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:29,186 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000490 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\xf0e\xd5\xc3\x8a\xa2\xcf\x01\x90W\xd2\xc3\x8a\xa2\xcf\x01\x90W\xd2\xc3\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:29,186 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:29,186 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:29,186 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:29,186 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:29,196 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:29,196 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:29,196 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000490 FileInformation => \xa0\xb0\x1c\xbf\x8a\xa2\xcf\x01 \xed\xd6\xc3\x8a\xa2\xcf\x01 \xed\xd6\xc3\x8a\xa2\xcf\x01 \xed\xd6\xc3\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00\x1a\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:29,226 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:29,236 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:29,236 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:29,236 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:29,236 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:29,236 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:29,236 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:29,236 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:29,246 | 1640 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:29,246 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:29,556 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:29,556 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:29,556 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:29,556 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:29,556 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:29,556 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:29,556 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000490 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\xe0 \xdd\xc3\x8a\xa2\xcf\x01\xe0 \xdd\xc3\x8a\xa2\xcf\x01\xe0 \xdd\xc3\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:29,556 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:29,556 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:29,556 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:29,556 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:29,556 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:29,566 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:29,566 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000490 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\x10w\x0f\xc4\x8a\xa2\xcf\x01\xe0 \xdd\xc3\x8a\xa2\xcf\x01\xe0 \xdd\xc3\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:29,566 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:29,566 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:29,566 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:29,566 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:29,566 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:29,566 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:29,566 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000490 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01@\xfe\x10\xc4\x8a\xa2\xcf\x01\xe0 \xdd\xc3\x8a\xa2\xcf\x01\xe0 \xdd\xc3\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:29,566 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:29,566 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:29,566 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:29,566 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:29,576 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:29,576 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:29,576 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000490 FileInformation => \xa0\xb0\x1c\xbf\x8a\xa2\xcf\x01p\x85\x12\xc4\x8a\xa2\xcf\x01p\x85\x12\xc4\x8a\xa2\xcf\x01p\x85\x12\xc4\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00\x1b\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:29,576 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:29,576 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:29,576 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:29,576 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:29,576 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:29,576 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:29,576 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:29,576 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:29,576 | 1640 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:29,576 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:29,576 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:29,576 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:29,576 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:29,576 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:29,576 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:29,576 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:29,576 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000490 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01p\x85\x12\xc4\x8a\xa2\xcf\x01p\x85\x12\xc4\x8a\xa2\xcf\x01p\x85\x12\xc4\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:29,586 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:29,586 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:29,586 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:29,586 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:29,586 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:29,586 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:29,586 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000490 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\xa0\x0c\x14\xc4\x8a\xa2\xcf\x01p\x85\x12\xc4\x8a\xa2\xcf\x01p\x85\x12\xc4\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:29,586 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:29,586 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:29,586 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:29,586 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:29,586 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:29,586 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:29,586 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000490 FileInformation => \xa0\xb0\x1c\xbf\x8a\xa2\xcf\x01\xa0\x0c\x14\xc4\x8a\xa2\xcf\x01\xa0\x0c\x14\xc4\x8a\xa2\xcf\x01\xa0\x0c\x14\xc4\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00\x1c\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:29,616 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:29,616 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:29,616 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:29,616 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:29,616 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:29,616 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:29,616 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:29,616 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:29,616 | 1640 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:29,616 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:29,937 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:29,937 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:29,937 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:29,937 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:29,937 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:29,937 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:29,937 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000490 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x010\xa2\x18\xc4\x8a\xa2\xcf\x010\xa2\x18\xc4\x8a\xa2\xcf\x010\xa2\x18\xc4\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:29,947 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:29,947 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:29,947 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:29,947 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:29,947 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:29,947 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:29,957 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000490 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x010\x88I\xc4\x8a\xa2\xcf\x010\xa2\x18\xc4\x8a\xa2\xcf\x010\xa2\x18\xc4\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:29,957 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:29,957 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:29,957 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:29,957 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:29,957 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:29,957 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:29,957 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000490 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\x90\x96L\xc4\x8a\xa2\xcf\x010\xa2\x18\xc4\x8a\xa2\xcf\x010\xa2\x18\xc4\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:29,967 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:29,967 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:29,967 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:29,967 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:29,967 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:29,967 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:29,967 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000490 FileInformation => \xa0\xb0\x1c\xbf\x8a\xa2\xcf\x01\xc0\x1dN\xc4\x8a\xa2\xcf\x01\xc0\x1dN\xc4\x8a\xa2\xcf\x01\xc0\x1dN\xc4\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00\x1d\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:29,977 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:29,977 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:29,977 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:29,977 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:29,977 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:29,977 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:29,977 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:29,987 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:29,987 | 1640 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:29,987 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:29,987 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:29,987 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:29,987 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:29,987 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:29,987 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:29,997 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:29,997 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000490 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\xf0\xa4O\xc4\x8a\xa2\xcf\x01\xf0\xa4O\xc4\x8a\xa2\xcf\x01\xf0\xa4O\xc4\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:29,997 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:29,997 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:29,997 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:29,997 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:29,997 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:29,997 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:29,997 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000490 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01P\xb3R\xc4\x8a\xa2\xcf\x01\xf0\xa4O\xc4\x8a\xa2\xcf\x01\xf0\xa4O\xc4\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:30,007 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:30,007 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:30,007 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:30,007 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:30,007 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:30,007 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:30,007 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000490 FileInformation => \xa0\xb0\x1c\xbf\x8a\xa2\xcf\x01\x80:T\xc4\x8a\xa2\xcf\x01\x80:T\xc4\x8a\xa2\xcf\x01\x80:T\xc4\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00\x1e\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:30,017 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:30,017 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:30,017 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:30,017 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:30,017 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:30,017 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:30,017 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:30,027 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:30,027 | 1640 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:30,027 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:30,337 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:30,337 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:30,337 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:30,337 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:30,337 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:30,337 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:30,337 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000490 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\xb0\xc1U\xc4\x8a\xa2\xcf\x01\xb0\xc1U\xc4\x8a\xa2\xcf\x01\xb0\xc1U\xc4\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:30,337 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:30,337 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:30,347 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:30,347 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:30,347 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:30,347 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:30,347 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000490 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\xb0\xa7\x86\xc4\x8a\xa2\xcf\x01\xb0\xc1U\xc4\x8a\xa2\xcf\x01\xb0\xc1U\xc4\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:30,347 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:30,357 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:30,357 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:30,357 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:30,357 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:30,357 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:30,357 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000490 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\xe0.\x88\xc4\x8a\xa2\xcf\x01\xb0\xc1U\xc4\x8a\xa2\xcf\x01\xb0\xc1U\xc4\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:30,357 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:30,357 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:30,357 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:30,367 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:30,367 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:30,367 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:30,367 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000490 FileInformation => \xa0\xb0\x1c\xbf\x8a\xa2\xcf\x01@=\x8b\xc4\x8a\xa2\xcf\x01@=\x8b\xc4\x8a\xa2\xcf\x01@=\x8b\xc4\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:30,377 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:30,377 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:30,377 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:30,377 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:30,377 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:30,377 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:30,377 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:30,377 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:30,377 | 1640 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:30,377 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:30,387 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:30,387 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:30,387 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:30,387 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:30,387 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:30,387 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:30,387 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000490 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01p\xc4\x8c\xc4\x8a\xa2\xcf\x01p\xc4\x8c\xc4\x8a\xa2\xcf\x01p\xc4\x8c\xc4\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:30,397 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:30,397 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:30,397 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:30,397 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:30,397 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:30,397 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:30,397 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000490 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\xd0\xd2\x8f\xc4\x8a\xa2\xcf\x01p\xc4\x8c\xc4\x8a\xa2\xcf\x01p\xc4\x8c\xc4\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:30,397 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:30,397 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:30,407 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:30,407 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:30,407 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:30,407 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:30,407 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000490 FileInformation => \xa0\xb0\x1c\xbf\x8a\xa2\xcf\x01\x00Z\x91\xc4\x8a\xa2\xcf\x01\x00Z\x91\xc4\x8a\xa2\xcf\x01\x00Z\x91\xc4\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:30,458 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:30,458 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:30,458 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:30,458 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:30,458 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:30,458 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:30,458 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:30,458 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:30,458 | 1640 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:30,458 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:30,768 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:30,768 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:30,768 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:30,768 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:30,768 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:30,768 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:30,768 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000490 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\xc0v\x97\xc4\x8a\xa2\xcf\x01\xc0v\x97\xc4\x8a\xa2\xcf\x01\xc0v\x97\xc4\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:30,768 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:30,768 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:30,768 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:30,768 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:30,768 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:30,768 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:30,768 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000490 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\xc0\\xc8\xc4\x8a\xa2\xcf\x01\xc0v\x97\xc4\x8a\xa2\xcf\x01\xc0v\x97\xc4\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:30,768 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:30,778 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:30,778 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:30,778 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:30,778 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:30,778 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:30,778 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000490 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\xc0\\xc8\xc4\x8a\xa2\xcf\x01\xc0v\x97\xc4\x8a\xa2\xcf\x01\xc0v\x97\xc4\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:30,778 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:30,778 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:30,778 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:30,778 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:30,778 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:30,778 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:30,778 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000490 FileInformation => \xa0\xb0\x1c\xbf\x8a\xa2\xcf\x01\xf0\xe3\xc9\xc4\x8a\xa2\xcf\x01\xf0\xe3\xc9\xc4\x8a\xa2\xcf\x01\xf0\xe3\xc9\xc4\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00!\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:30,778 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:30,788 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:30,788 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:30,788 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:30,788 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:30,788 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:30,788 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:30,788 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:30,788 | 1640 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:30,788 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:30,788 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:30,788 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:30,788 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:30,788 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:30,788 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:30,788 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:30,788 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000490 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\xf0\xe3\xc9\xc4\x8a\xa2\xcf\x01\xf0\xe3\xc9\xc4\x8a\xa2\xcf\x01\xf0\xe3\xc9\xc4\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:30,788 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:30,788 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:30,788 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:30,788 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:30,788 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:30,788 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:30,788 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000490 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01 k\xcb\xc4\x8a\xa2\xcf\x01\xf0\xe3\xc9\xc4\x8a\xa2\xcf\x01\xf0\xe3\xc9\xc4\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:30,788 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:30,788 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:30,788 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:30,788 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:30,798 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:30,798 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:30,798 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000490 FileInformation => \xa0\xb0\x1c\xbf\x8a\xa2\xcf\x01P\xf2\xcc\xc4\x8a\xa2\xcf\x01P\xf2\xcc\xc4\x8a\xa2\xcf\x01P\xf2\xcc\xc4\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00"\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:30,838 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:30,838 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:30,838 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:30,838 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:30,838 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:30,838 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:30,838 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:30,838 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:30,848 | 1640 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:30,848 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:31,169 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:31,169 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:31,169 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:31,169 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:31,169 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:31,169 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:31,169 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000490 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\x10\x0f\xd3\xc4\x8a\xa2\xcf\x01\x10\x0f\xd3\xc4\x8a\xa2\xcf\x01\x10\x0f\xd3\xc4\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:31,169 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:31,179 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:31,179 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:31,179 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:31,179 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:31,179 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:31,179 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000490 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01@|\x05\xc5\x8a\xa2\xcf\x01\x10\x0f\xd3\xc4\x8a\xa2\xcf\x01\x10\x0f\xd3\xc4\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:31,189 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:31,189 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:31,189 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:31,189 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:31,189 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:31,189 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:31,189 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000490 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01p\x03\x07\xc5\x8a\xa2\xcf\x01\x10\x0f\xd3\xc4\x8a\xa2\xcf\x01\x10\x0f\xd3\xc4\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:31,199 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:31,199 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:31,199 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:31,199 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:31,199 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:31,199 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:31,199 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000490 FileInformation => \xa0\xb0\x1c\xbf\x8a\xa2\xcf\x01\xd0\x11 \xc5\x8a\xa2\xcf\x01\xd0\x11 \xc5\x8a\xa2\xcf\x01\xd0\x11 \xc5\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00#\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:31,209 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:31,209 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:31,209 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:31,209 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:31,219 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:31,219 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:31,219 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:31,219 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:31,219 | 1640 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:31,219 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:31,229 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:31,229 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:31,229 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:31,229 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:31,229 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:31,229 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:31,229 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000490 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\x00\x99\x0b\xc5\x8a\xa2\xcf\x01\x00\x99\x0b\xc5\x8a\xa2\xcf\x01\x00\x99\x0b\xc5\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:31,229 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:31,229 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:31,239 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:31,239 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:31,239 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:31,239 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:31,239 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000490 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01`\xa7\x0e\xc5\x8a\xa2\xcf\x01\x00\x99\x0b\xc5\x8a\xa2\xcf\x01\x00\x99\x0b\xc5\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:31,239 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:31,239 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:31,249 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:31,249 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:31,249 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:31,249 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:31,249 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000490 FileInformation => \xa0\xb0\x1c\xbf\x8a\xa2\xcf\x01\xc0\xb5\x11\xc5\x8a\xa2\xcf\x01\xc0\xb5\x11\xc5\x8a\xa2\xcf\x01\xc0\xb5\x11\xc5\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00$\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:31,289 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:31,289 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:31,289 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:31,289 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:31,289 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:31,289 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:31,289 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:31,289 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:31,289 | 1640 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:31,289 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:31,619 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:31,619 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:31,619 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:31,619 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:31,619 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:31,619 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:31,619 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000490 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\x80\xd2\x17\xc5\x8a\xa2\xcf\x01\x80\xd2\x17\xc5\x8a\xa2\xcf\x01\x80\xd2\x17\xc5\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:31,629 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:31,629 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:31,629 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:31,629 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:31,629 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:31,629 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:31,639 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000490 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\xe0\xc6K\xc5\x8a\xa2\xcf\x01\x80\xd2\x17\xc5\x8a\xa2\xcf\x01\x80\xd2\x17\xc5\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:31,639 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:31,639 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:31,639 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:31,639 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:31,639 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:31,639 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:31,639 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000490 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\x10NM\xc5\x8a\xa2\xcf\x01\x80\xd2\x17\xc5\x8a\xa2\xcf\x01\x80\xd2\x17\xc5\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:31,649 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:31,649 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:31,649 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:31,649 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:31,649 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:31,649 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:31,649 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000490 FileInformation => \xa0\xb0\x1c\xbf\x8a\xa2\xcf\x01@\xd5N\xc5\x8a\xa2\xcf\x01@\xd5N\xc5\x8a\xa2\xcf\x01@\xd5N\xc5\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00%\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:31,659 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:31,659 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:31,659 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:31,659 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:31,669 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:31,669 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:31,669 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:31,669 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:31,669 | 1640 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:31,669 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:31,669 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:31,669 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:31,669 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:31,669 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:31,679 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:31,679 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:31,679 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000490 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01p\P\xc5\x8a\xa2\xcf\x01p\P\xc5\x8a\xa2\xcf\x01p\P\xc5\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:31,679 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:31,679 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:31,679 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:31,679 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:31,679 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:31,679 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:31,679 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000490 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\xd0jS\xc5\x8a\xa2\xcf\x01p\P\xc5\x8a\xa2\xcf\x01p\P\xc5\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:31,689 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:31,689 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:31,689 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:31,689 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:31,689 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:31,689 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:31,689 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000490 FileInformation => \xa0\xb0\x1c\xbf\x8a\xa2\xcf\x01\x00\xf2T\xc5\x8a\xa2\xcf\x01\x00\xf2T\xc5\x8a\xa2\xcf\x01\x00\xf2T\xc5\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00&\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:31,839 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:31,839 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:31,839 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:31,839 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:31,839 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:31,839 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:31,839 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:31,839 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:31,839 | 1640 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:31,839 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:32,160 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:32,160 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:32,160 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:32,160 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:32,160 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:32,160 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:32,160 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000490 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01@Hg\xc5\x8a\xa2\xcf\x01@Hg\xc5\x8a\xa2\xcf\x01@Hg\xc5\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:32,170 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:32,170 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:32,170 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:32,170 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:32,170 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:32,180 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:32,180 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000490 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\x00K\x9e\xc5\x8a\xa2\xcf\x01@Hg\xc5\x8a\xa2\xcf\x01@Hg\xc5\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:32,180 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:32,180 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:32,180 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:32,180 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:32,190 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:32,190 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:32,190 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000490 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x010\xd2\x9f\xc5\x8a\xa2\xcf\x01@Hg\xc5\x8a\xa2\xcf\x01@Hg\xc5\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:32,190 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:32,190 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:32,190 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:32,190 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:32,190 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:32,190 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:32,190 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000490 FileInformation => \xa0\xb0\x1c\xbf\x8a\xa2\xcf\x01`Y\xa1\xc5\x8a\xa2\xcf\x01`Y\xa1\xc5\x8a\xa2\xcf\x01`Y\xa1\xc5\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00'\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:32,210 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:32,210 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:32,220 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:32,220 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:32,220 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:32,220 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:32,220 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:32,220 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:32,220 | 1640 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:32,220 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:32,220 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:32,220 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:32,220 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:32,230 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:32,230 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:32,230 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:32,230 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000490 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\xc0g\xa4\xc5\x8a\xa2\xcf\x01\xc0g\xa4\xc5\x8a\xa2\xcf\x01\xc0g\xa4\xc5\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:32,230 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:32,240 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:32,240 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:32,240 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:32,240 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:32,240 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:32,240 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000490 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01 v\xa7\xc5\x8a\xa2\xcf\x01\xc0g\xa4\xc5\x8a\xa2\xcf\x01\xc0g\xa4\xc5\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:32,240 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:32,240 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:32,250 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:32,250 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:32,250 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:32,250 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:32,250 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000490 FileInformation => \xa0\xb0\x1c\xbf\x8a\xa2\xcf\x01\x80\x84\xaa\xc5\x8a\xa2\xcf\x01\x80\x84\xaa\xc5\x8a\xa2\xcf\x01\x80\x84\xaa\xc5\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:32,270 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:32,270 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:32,270 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:32,270 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:32,270 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:32,270 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:32,270 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:32,270 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:32,270 | 1640 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:32,270 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:32,581 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:32,581 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:32,581 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:32,581 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:32,581 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:32,581 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:32,581 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000490 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\xe0\x92\xad\xc5\x8a\xa2\xcf\x01\xe0\x92\xad\xc5\x8a\xa2\xcf\x01\xe0\x92\xad\xc5\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:32,591 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:32,591 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:32,591 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:32,591 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:32,591 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:32,601 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:32,601 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000490 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\xe0x\xde\xc5\x8a\xa2\xcf\x01\xe0\x92\xad\xc5\x8a\xa2\xcf\x01\xe0\x92\xad\xc5\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:32,601 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:32,601 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:32,601 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:32,601 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:32,601 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:32,611 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:32,611 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000490 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\x10\x00\xe0\xc5\x8a\xa2\xcf\x01\xe0\x92\xad\xc5\x8a\xa2\xcf\x01\xe0\x92\xad\xc5\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:32,611 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:32,611 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:32,611 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:32,611 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:32,621 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:32,621 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:32,621 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000490 FileInformation => \xa0\xb0\x1c\xbf\x8a\xa2\xcf\x01p\x0e\xe3\xc5\x8a\xa2\xcf\x01p\x0e\xe3\xc5\x8a\xa2\xcf\x01p\x0e\xe3\xc5\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00)\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:32,631 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:32,631 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:32,631 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:32,631 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:32,631 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:32,631 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:32,631 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:32,641 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:32,641 | 1640 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:32,641 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:32,641 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:32,641 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:32,641 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:32,641 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:32,641 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:32,641 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:32,641 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000490 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\xa0\x95\xe4\xc5\x8a\xa2\xcf\x01\xa0\x95\xe4\xc5\x8a\xa2\xcf\x01\xa0\x95\xe4\xc5\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:32,651 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:32,651 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:32,651 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:32,651 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:32,651 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:32,651 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:32,661 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000490 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\x00\xa4\xe7\xc5\x8a\xa2\xcf\x01\xa0\x95\xe4\xc5\x8a\xa2\xcf\x01\xa0\x95\xe4\xc5\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:32,661 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:32,661 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:32,661 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:32,661 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:32,661 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:32,661 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:32,661 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000490 FileInformation => \xa0\xb0\x1c\xbf\x8a\xa2\xcf\x010+\xe9\xc5\x8a\xa2\xcf\x010+\xe9\xc5\x8a\xa2\xcf\x010+\xe9\xc5\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00*\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:32,711 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:32,711 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:32,711 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:32,711 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:32,711 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:32,711 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:32,711 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:32,711 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:32,721 | 1640 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:32,721 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:33,041 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:33,041 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:33,041 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:33,041 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:33,041 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:33,041 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:33,041 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000490 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01 \xcf\xf0\xc5\x8a\xa2\xcf\x01 \xcf\xf0\xc5\x8a\xa2\xcf\x01 \xcf\xf0\xc5\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:33,051 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:33,051 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:33,051 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:33,051 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:33,051 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:33,051 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:33,051 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000490 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\x80\xc3$\xc6\x8a\xa2\xcf\x01 \xcf\xf0\xc5\x8a\xa2\xcf\x01 \xcf\xf0\xc5\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:33,051 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:33,051 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:33,051 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:33,051 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:33,051 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:33,051 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:33,051 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000490 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\x80\xc3$\xc6\x8a\xa2\xcf\x01 \xcf\xf0\xc5\x8a\xa2\xcf\x01 \xcf\xf0\xc5\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:33,051 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:33,051 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:33,051 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:33,051 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:33,051 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:33,051 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:33,051 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000490 FileInformation => \xa0\xb0\x1c\xbf\x8a\xa2\xcf\x01\x80\xc3$\xc6\x8a\xa2\xcf\x01\x80\xc3$\xc6\x8a\xa2\xcf\x01\x80\xc3$\xc6\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00+\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:33,071 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:33,071 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:33,071 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:33,071 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:33,071 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:33,071 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:33,071 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:33,071 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:33,071 | 1640 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:33,071 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:33,071 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:33,071 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:33,071 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:33,071 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:33,071 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:33,071 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:33,071 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000490 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\xe0\xd1'\xc6\x8a\xa2\xcf\x01\xe0\xd1'\xc6\x8a\xa2\xcf\x01\xe0\xd1'\xc6\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:33,071 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:33,071 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:33,071 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:33,071 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:33,071 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:33,071 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:33,071 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000490 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\xe0\xd1'\xc6\x8a\xa2\xcf\x01\xe0\xd1'\xc6\x8a\xa2\xcf\x01\xe0\xd1'\xc6\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:33,071 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:33,071 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:33,071 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:33,071 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:33,071 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:33,071 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:33,071 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000490 FileInformation => \xa0\xb0\x1c\xbf\x8a\xa2\xcf\x01\xe0\xd1'\xc6\x8a\xa2\xcf\x01\xe0\xd1'\xc6\x8a\xa2\xcf\x01\xe0\xd1'\xc6\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00,\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:33,101 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:33,101 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:33,101 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:33,101 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:33,101 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:33,101 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:33,101 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:33,101 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:33,111 | 1640 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:33,111 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:33,432 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:33,432 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:33,432 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:33,432 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:33,432 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:33,432 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:33,432 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000490 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01pg,\xc6\x8a\xa2\xcf\x01pg,\xc6\x8a\xa2\xcf\x01pg,\xc6\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:33,442 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:33,442 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:33,442 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:33,442 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:33,452 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:33,452 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:33,452 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000490 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\xd0[`\xc6\x8a\xa2\xcf\x01pg,\xc6\x8a\xa2\xcf\x01pg,\xc6\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:33,452 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:33,462 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:33,462 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:33,472 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:33,472 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:33,472 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:33,472 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000490 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\x00\xe3a\xc6\x8a\xa2\xcf\x01pg,\xc6\x8a\xa2\xcf\x01pg,\xc6\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:33,472 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:33,482 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:33,482 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:33,482 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:33,482 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:33,482 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:33,482 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000490 FileInformation => \xa0\xb0\x1c\xbf\x8a\xa2\xcf\x01\x90xf\xc6\x8a\xa2\xcf\x01\x90xf\xc6\x8a\xa2\xcf\x01\x90xf\xc6\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00-\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:33,532 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:33,532 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:33,532 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:33,532 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:33,532 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:33,532 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:33,532 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:33,532 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:33,532 | 1640 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:33,532 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:33,542 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:33,542 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:33,542 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:33,542 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:33,542 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:33,542 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:33,542 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000490 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\x80\x1cn\xc6\x8a\xa2\xcf\x01\x80\x1cn\xc6\x8a\xa2\xcf\x01\x80\x1cn\xc6\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:33,552 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:33,552 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:33,552 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:33,552 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:33,552 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:33,552 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:33,552 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000490 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\xe0*q\xc6\x8a\xa2\xcf\x01\x80\x1cn\xc6\x8a\xa2\xcf\x01\x80\x1cn\xc6\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:33,552 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:33,552 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:33,552 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:33,562 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:33,562 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:33,562 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:33,562 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000490 FileInformation => \xa0\xb0\x1c\xbf\x8a\xa2\xcf\x01\x10\xb2r\xc6\x8a\xa2\xcf\x01\x10\xb2r\xc6\x8a\xa2\xcf\x01\x10\xb2r\xc6\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00.\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:33,602 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:33,612 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:33,612 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:33,612 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:33,612 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:33,612 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:33,612 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:33,612 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:33,612 | 1640 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:33,612 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:33,943 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:33,943 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:33,943 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:33,943 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:33,943 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:33,943 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:33,943 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000490 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\xd0\xcex\xc6\x8a\xa2\xcf\x01\xd0\xcex\xc6\x8a\xa2\xcf\x01\xd0\xcex\xc6\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:33,943 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:33,953 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:33,953 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:33,953 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:33,953 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:33,953 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:33,963 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000490 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x010\xc3\xac\xc6\x8a\xa2\xcf\x01\xd0\xcex\xc6\x8a\xa2\xcf\x01\xd0\xcex\xc6\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:33,963 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:33,963 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:33,963 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:33,963 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:33,963 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:33,963 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:33,963 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000490 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\x90\xd1\xaf\xc6\x8a\xa2\xcf\x01\xd0\xcex\xc6\x8a\xa2\xcf\x01\xd0\xcex\xc6\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:33,973 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:33,973 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:33,973 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:33,973 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:33,973 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:33,973 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:33,973 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000490 FileInformation => \xa0\xb0\x1c\xbf\x8a\xa2\xcf\x01\xc0X\xb1\xc6\x8a\xa2\xcf\x01\xc0X\xb1\xc6\x8a\xa2\xcf\x01\xc0X\xb1\xc6\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00/\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:33,983 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:33,983 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:33,983 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:33,983 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:33,993 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:33,993 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:33,993 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:33,993 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:33,993 | 1640 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:33,993 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:33,993 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:33,993 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:33,993 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:33,993 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:33,993 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:33,993 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:33,993 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000490 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\xf0\xdf\xb2\xc6\x8a\xa2\xcf\x01\xf0\xdf\xb2\xc6\x8a\xa2\xcf\x01\xf0\xdf\xb2\xc6\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:34,003 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:34,003 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:34,003 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:34,003 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:34,003 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:34,003 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:34,003 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000490 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01P\xee\xb5\xc6\x8a\xa2\xcf\x01\xf0\xdf\xb2\xc6\x8a\xa2\xcf\x01\xf0\xdf\xb2\xc6\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:34,013 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:34,013 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:34,013 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:34,013 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:34,013 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:34,013 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:34,013 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000490 FileInformation => \xa0\xb0\x1c\xbf\x8a\xa2\xcf\x01\x80u\xb7\xc6\x8a\xa2\xcf\x01\x80u\xb7\xc6\x8a\xa2\xcf\x01\x80u\xb7\xc6\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x000\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:34,193 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:34,193 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:34,193 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:34,193 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:34,193 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:34,193 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:34,193 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:34,193 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:34,193 | 1640 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:34,193 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:34,513 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:34,513 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:34,513 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:34,513 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:34,513 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:34,513 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:34,523 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000490 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\xe0\xf6\xd2\xc6\x8a\xa2\xcf\x01\xe0\xf6\xd2\xc6\x8a\xa2\xcf\x01\xe0\xf6\xd2\xc6\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:34,523 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:34,523 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:34,523 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:34,533 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:34,533 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:34,533 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:34,533 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000490 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\x10d\x05\xc7\x8a\xa2\xcf\x01\xe0\xf6\xd2\xc6\x8a\xa2\xcf\x01\xe0\xf6\xd2\xc6\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:34,533 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:34,533 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:34,543 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:34,543 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:34,543 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:34,543 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:34,543 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000490 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01@\xeb\x06\xc7\x8a\xa2\xcf\x01\xe0\xf6\xd2\xc6\x8a\xa2\xcf\x01\xe0\xf6\xd2\xc6\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:34,543 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:34,543 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:34,543 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:34,543 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:34,553 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:34,553 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:34,553 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000490 FileInformation => \xa0\xb0\x1c\xbf\x8a\xa2\xcf\x01pr\x08\xc7\x8a\xa2\xcf\x01pr\x08\xc7\x8a\xa2\xcf\x01pr\x08\xc7\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x001\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:34,573 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:34,573 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:34,573 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:34,573 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:34,573 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:34,573 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:34,573 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:34,573 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:34,573 | 1640 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:34,573 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:34,583 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:34,583 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:34,583 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:34,583 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:34,583 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:34,583 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:34,583 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000490 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\xd0\x80\x0b\xc7\x8a\xa2\xcf\x01\xd0\x80\x0b\xc7\x8a\xa2\xcf\x01\xd0\x80\x0b\xc7\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:34,583 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:34,593 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:34,593 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:34,593 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:34,593 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:34,593 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:34,593 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000490 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x010\x8f\x0e\xc7\x8a\xa2\xcf\x01\xd0\x80\x0b\xc7\x8a\xa2\xcf\x01\xd0\x80\x0b\xc7\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:34,593 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:34,603 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:34,603 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:34,603 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:34,603 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:34,603 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:34,603 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000490 FileInformation => \xa0\xb0\x1c\xbf\x8a\xa2\xcf\x01\x90\x9d\x11\xc7\x8a\xa2\xcf\x01\x90\x9d\x11\xc7\x8a\xa2\xcf\x01\x90\x9d\x11\xc7\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x002\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:34,623 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:34,623 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:34,623 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:34,623 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:34,634 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:34,634 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:34,634 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:34,634 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:34,634 | 1640 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:34,634 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:34,944 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:34,944 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:34,944 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:34,944 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:34,944 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:34,944 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:34,944 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000490 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\xc0$\x13\xc7\x8a\xa2\xcf\x01\xc0$\x13\xc7\x8a\xa2\xcf\x01\xc0$\x13\xc7\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:34,954 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:34,954 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:34,954 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:34,954 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:34,954 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:34,964 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:34,964 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000490 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01 \x19G\xc7\x8a\xa2\xcf\x01\xc0$\x13\xc7\x8a\xa2\xcf\x01\xc0$\x13\xc7\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:34,964 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:34,964 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:34,964 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:34,964 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:34,964 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:34,964 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:34,964 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000490 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01P\xa0H\xc7\x8a\xa2\xcf\x01\xc0$\x13\xc7\x8a\xa2\xcf\x01\xc0$\x13\xc7\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:34,974 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:34,974 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:34,974 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:34,974 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:34,974 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:34,974 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:34,974 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000490 FileInformation => \xa0\xb0\x1c\xbf\x8a\xa2\xcf\x01\x80'J\xc7\x8a\xa2\xcf\x01\x80'J\xc7\x8a\xa2\xcf\x01\x80'J\xc7\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x003\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:34,984 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:34,984 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:34,984 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:34,984 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:34,994 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:34,994 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:34,994 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:34,994 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:34,994 | 1640 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:34,994 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:34,994 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:34,994 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:34,994 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:34,994 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:34,994 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:35,004 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:35,004 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000490 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\xb0\xaeK\xc7\x8a\xa2\xcf\x01\xb0\xaeK\xc7\x8a\xa2\xcf\x01\xb0\xaeK\xc7\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:35,004 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:35,004 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:35,004 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:35,004 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:35,004 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:35,004 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:35,004 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000490 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\x10\xbdN\xc7\x8a\xa2\xcf\x01\xb0\xaeK\xc7\x8a\xa2\xcf\x01\xb0\xaeK\xc7\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:35,004 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:35,014 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:35,014 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:35,014 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:35,014 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:35,014 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:35,014 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000490 FileInformation => \xa0\xb0\x1c\xbf\x8a\xa2\xcf\x01@DP\xc7\x8a\xa2\xcf\x01@DP\xc7\x8a\xa2\xcf\x01@DP\xc7\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x004\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:35,034 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:35,034 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:35,034 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:35,034 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:35,034 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:35,034 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:35,034 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:35,034 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:35,034 | 1640 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:35,034 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:35,365 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:35,365 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:35,365 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:35,365 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:35,365 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:35,365 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:35,365 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000490 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\xa0RS\xc7\x8a\xa2\xcf\x01\xa0RS\xc7\x8a\xa2\xcf\x01\xa0RS\xc7\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:35,365 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:35,365 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:35,365 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:35,375 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:35,375 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:35,375 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:35,375 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000490 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\xd0\xbf\x85\xc7\x8a\xa2\xcf\x01\xa0RS\xc7\x8a\xa2\xcf\x01\xa0RS\xc7\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:35,375 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:35,375 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:35,375 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:35,375 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:35,375 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:35,375 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:35,375 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000490 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01\x00G\x87\xc7\x8a\xa2\xcf\x01\xa0RS\xc7\x8a\xa2\xcf\x01\xa0RS\xc7\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:35,375 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:35,375 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:35,375 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:35,375 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:35,385 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:35,385 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:35,385 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000490 FileInformation => \xa0\xb0\x1c\xbf\x8a\xa2\xcf\x010\xce\x88\xc7\x8a\xa2\xcf\x010\xce\x88\xc7\x8a\xa2\xcf\x010\xce\x88\xc7\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x005\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:35,395 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:35,395 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:35,395 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:35,395 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:35,395 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:35,395 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:35,395 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:35,395 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:35,395 | 1640 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:35,395 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:35,395 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:35,395 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:35,395 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:35,395 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:35,395 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:35,395 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:35,395 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000490 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x010\xce\x88\xc7\x8a\xa2\xcf\x010\xce\x88\xc7\x8a\xa2\xcf\x010\xce\x88\xc7\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:35,395 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:35,395 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:35,395 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:35,395 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:35,395 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:35,395 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:35,395 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000490 FileInformation => \x90\x8dB\xb6\x8a\xa2\xcf\x01`U\x8a\xc7\x8a\xa2\xcf\x010\xce\x88\xc7\x8a\xa2\xcf\x010\xce\x88\xc7\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:35,395 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:35,395 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:35,395 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:35,395 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:35,395 | 1640 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:35,395 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:35,395 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000490 FileInformation => \xa0\xb0\x1c\xbf\x8a\xa2\xcf\x01`U\x8a\xc7\x8a\xa2\xcf\x01`U\x8a\xc7\x8a\xa2\xcf\x01`U\x8a\xc7\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x006\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:18:35,455 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:35,455 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:35,455 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:35,455 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:35,455 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02c100d0 | |
| 09:18:35,455 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02c100d0 | |
| 09:18:35,455 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02c100d0 | |
| 09:18:35,455 | 1640 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02c100d0 | |
| 09:18:35,455 | 1640 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:35,455 | 1640 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000494 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:18:40,232 | 1640 | RegOpenKeyExW |
Handle => 0x00000490 Registry => 0x80000002 SubKey => System |
SUCCESS | 0x00000000 | |
| 09:18:40,232 | 1640 | RegCloseKey |
Handle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:40,242 | 1640 | RegCreateKeyExW |
Handle => 0x00000490 Access => 33554432 Registry => 0x80000002 Class => SubKey => System\Acrobatbrokerserverdispatchercpp789 |
SUCCESS | 0x00000000 | |
| 09:18:40,242 | 1640 | RegCloseKey |
Handle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:40,242 | 1640 | RegDeleteKeyW |
Handle => 0x80000002 SubKey => System\Acrobatbrokerserverdispatchercpp789 |
SUCCESS | 0x00000000 | |
| 09:18:40,242 | 1640 | RegOpenKeyExW |
Handle => 0x00000490 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion |
SUCCESS | 0x00000000 | |
| 09:18:40,242 | 1640 | RegQueryValueExW |
Handle => 0x00000490 Data => C\x00:\x00\\x00P\x00r\x00o\x00g\x00r\x00a\x00m\x00 \x00F\x00i\x00l\x00e\x00s\x00\\x00C\x00o\x00m\x00m\x00o\x00n\x00 \x00F\x00i\x00l\x00e\x00s\x00\x00\x00 ValueName => CommonFilesDir |
SUCCESS | 0x00000000 | |
| 09:18:40,252 | 1640 | RegCloseKey |
Handle => 0x00000490 |
SUCCESS | 0x00000000 | |
| 09:18:40,292 | 1640 | ShellExecuteExW |
Show => 1 Parameters => /PRODUCT:Reader /VERSION:11.0 /MODE:3 FilePath => "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" |
SUCCESS | 0x00000001 | |
| 09:18:44,908 | 520 | select |
socket => 0x00000003 |
SUCCESS | 0x00000001 | |
| 09:18:44,908 | 1640 | closesocket |
socket => 0x00000458 |
SUCCESS | 0x00000000 | |
| 09:18:44,908 | 1640 | OpenSCManagerW |
MachineName => DatabaseName => DesiredAccess => 2147483648 |
SUCCESS | 0x0025fad0 | |
| 09:18:44,908 | 1640 | OpenServiceW |
ServiceControlManager => 0x0025fad0 ServiceName => RASMAN DesiredAccess => 4 |
SUCCESS | 0x00249f88 | |
| 09:18:44,908 | 1640 | RegQueryValueExA |
Handle => 0x00000354 DataLength => 4 ValueName => EnableAutodial Type => 852 |
FAILURE | 0x00000002 | |
| 09:18:44,908 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000374 FileInformation => \x00\xc0\x03\x00\x00\x00\x00\x00\x00\xc0\x03\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:18:44,908 | 1640 | socket |
type => 1 protocol => 6 af => 2 |
SUCCESS | 0x00000458 | |
| 09:18:44,908 | 1640 | ioctlsocket |
command => 2147772030 socket => 0x00000458 |
SUCCESS | 0x00000000 | |
| 09:18:44,908 | 1640 | bind |
ip => 0.0.0.0 socket => 0x00000458 port => 0 |
SUCCESS | 0x00000000 | |
| 09:18:44,908 | 1640 | NtDeviceIoControlFile |
InputBuffer => FileHandle => 0x00000458 OutputBuffer => \x01\x00\x00\x00\x01\x00\x00\x00\x0e\x00\x02\x00\x04\x13\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:18:44,908 | 1640 | connect |
socket => 0x00000458 |
FAILURE | 4294967295 | |
| 09:18:44,918 | 520 | select |
socket => 0x00000002 |
SUCCESS | 0x00000001 | |
| 09:18:44,918 | 520 | WSARecv |
socket => 0x000003d0 |
SUCCESS | 0x00000000 | |
| 09:18:44,918 | 1640 | send |
buffer => ! socket => 0x000003d0 |
SUCCESS | 0x00000001 | |
| 09:18:48,914 | 520 | select |
socket => 0x00000003 |
SUCCESS | 0x00000001 | |
| 09:18:48,914 | 1640 | closesocket |
socket => 0x00000488 |
SUCCESS | 0x00000000 | |
| 09:18:48,914 | 1640 | OpenSCManagerW |
MachineName => DatabaseName => DesiredAccess => 2147483648 |
SUCCESS | 0x0024a028 | |
| 09:18:48,914 | 1640 | OpenServiceW |
ServiceControlManager => 0x0024a028 ServiceName => RASMAN DesiredAccess => 4 |
SUCCESS | 0x00249f88 | |
| 09:18:48,914 | 1640 | RegQueryValueExA |
Handle => 0x00000354 DataLength => 4 ValueName => EnableAutodial Type => 852 |
FAILURE | 0x00000002 | |
| 09:18:48,924 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000374 FileInformation => \x00\xc0\x03\x00\x00\x00\x00\x00\x00\xc0\x03\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:18:48,964 | 1640 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => InternetCloseHandle FunctionAddress => 0x771c4d8c ModuleHandle => 0x771b0000 |
SUCCESS | 0x00000000 | |
| 09:18:58,488 | 1380 | ExitThread |
ExitCode => 0 |
SUCCESS | 0x00000000 | |
| 09:19:05,939 | 520 | select |
socket => 0x00000002 |
SUCCESS | 0x00000001 | |
| 09:19:05,939 | 1640 | closesocket |
socket => 0x00000458 |
SUCCESS | 0x00000000 | |
| 09:19:05,939 | 1640 | RegQueryValueExA |
Handle => 0x00000418 Data => 0 ValueName => EnableFileTracing |
SUCCESS | 0x00000000 | |
| 09:19:05,939 | 1640 | RegQueryValueExA |
Handle => 0x00000418 Data => 4294901760 ValueName => FileTracingMask |
SUCCESS | 0x00000000 | |
| 09:19:05,939 | 1640 | RegQueryValueExA |
Handle => 0x00000418 Data => 0 ValueName => EnableConsoleTracing |
SUCCESS | 0x00000000 | |
| 09:19:05,939 | 1640 | RegQueryValueExA |
Handle => 0x00000418 Data => 4294901760 ValueName => ConsoleTracingMask |
SUCCESS | 0x00000000 | |
| 09:19:05,939 | 1640 | RegQueryValueExA |
Handle => 0x00000418 Data => 1048576 ValueName => MaxFileSize |
SUCCESS | 0x00000000 | |
| 09:19:05,939 | 1640 | RegQueryValueExA |
Handle => 0x00000418 Data => %windir%\tracing\x00 ValueName => FileDirectory |
SUCCESS | 0x00000000 | |
| 09:19:05,949 | 1640 | OpenSCManagerW |
MachineName => DatabaseName => DesiredAccess => 2147483648 |
SUCCESS | 0x001ee9d0 | |
| 09:19:05,949 | 1640 | OpenServiceW |
ServiceControlManager => 0x001ee9d0 ServiceName => RASMAN DesiredAccess => 4 |
SUCCESS | 0x00249f38 | |
| 09:19:05,949 | 1640 | RegQueryValueExA |
Handle => 0x00000354 DataLength => 4 ValueName => EnableAutodial Type => 852 |
FAILURE | 0x00000002 | |
| 09:19:05,949 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000374 FileInformation => \x00\xc0\x03\x00\x00\x00\x00\x00\x00\xc0\x03\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:19:05,959 | 1640 | socket |
type => 1 protocol => 6 af => 2 |
SUCCESS | 0x00000458 | |
| 09:19:05,959 | 1640 | ioctlsocket |
command => 2147772030 socket => 0x00000458 |
SUCCESS | 0x00000000 | |
| 09:19:05,959 | 1640 | bind |
ip => 0.0.0.0 socket => 0x00000458 port => 0 |
SUCCESS | 0x00000000 | |
| 09:19:05,959 | 1640 | NtDeviceIoControlFile |
InputBuffer => FileHandle => 0x00000458 OutputBuffer => \x01\x00\x00\x00\x01\x00\x00\x00\x0e\x00\x02\x00\x04\x16\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:19:05,959 | 1640 | connect |
socket => 0x00000458 |
FAILURE | 4294967295 | |
| 09:19:05,959 | 520 | select |
socket => 0x00000001 |
SUCCESS | 0x00000001 | |
| 09:19:05,959 | 520 | WSARecv |
socket => 0x000003d0 |
SUCCESS | 0x00000000 | |
| 09:19:05,959 | 1640 | send |
buffer => ! socket => 0x000003d0 |
SUCCESS | 0x00000001 | |
| 09:19:07,911 | 420 | ExitThread |
ExitCode => 0 |
SUCCESS | 0x00000000 | |
| 09:19:20,139 | 2004 | CreateThread |
ThreadId => 1752 StartRoutine => 0x77e76c7d Parameter => 0x001ef748 CreationFlags => 0 |
SUCCESS | 0x00000444 | |
| 09:19:26,969 | 520 | select |
socket => 0x00000002 |
SUCCESS | 0x00000001 | |
| 09:19:26,969 | 1640 | closesocket |
socket => 0x00000458 |
SUCCESS | 0x00000000 | |
| 09:19:26,969 | 1640 | OpenSCManagerW |
MachineName => DatabaseName => DesiredAccess => 2147483648 |
SUCCESS | 0x00249f10 | |
| 09:19:26,969 | 1640 | OpenServiceW |
ServiceControlManager => 0x00249f10 ServiceName => RASMAN DesiredAccess => 4 |
SUCCESS | 0x0025f918 | |
| 09:19:26,969 | 1640 | RegQueryValueExA |
Handle => 0x00000354 DataLength => 4 ValueName => EnableAutodial Type => 852 |
FAILURE | 0x00000002 | |
| 09:19:26,979 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000374 FileInformation => \x00\xc0\x03\x00\x00\x00\x00\x00\x00\xc0\x03\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:19:26,979 | 1640 | socket |
type => 1 protocol => 6 af => 2 |
SUCCESS | 0x00000458 | |
| 09:19:26,979 | 1640 | ioctlsocket |
command => 2147772030 socket => 0x00000458 |
SUCCESS | 0x00000000 | |
| 09:19:26,979 | 1640 | bind |
ip => 0.0.0.0 socket => 0x00000458 port => 0 |
SUCCESS | 0x00000000 | |
| 09:19:26,979 | 1640 | NtDeviceIoControlFile |
InputBuffer => FileHandle => 0x00000458 OutputBuffer => \x01\x00\x00\x00\x01\x00\x00\x00\x0e\x00\x02\x00\x04\x1b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:19:26,979 | 1640 | connect |
socket => 0x00000458 |
FAILURE | 4294967295 | |
| 09:19:26,989 | 520 | select |
socket => 0x00000001 |
SUCCESS | 0x00000001 | |
| 09:19:26,989 | 520 | WSARecv |
socket => 0x000003d0 |
SUCCESS | 0x00000000 | |
| 09:19:26,989 | 1640 | send |
buffer => ! socket => 0x000003d0 |
SUCCESS | 0x00000001 | |
| 09:19:47,899 | 520 | select |
socket => 0x00000002 |
SUCCESS | 0x00000001 | |
| 09:19:47,899 | 1640 | closesocket |
socket => 0x00000458 |
SUCCESS | 0x00000000 | |
| 09:19:47,899 | 1640 | OpenSCManagerW |
MachineName => DatabaseName => DesiredAccess => 2147483648 |
SUCCESS | 0x00249f10 | |
| 09:19:47,899 | 1640 | OpenServiceW |
ServiceControlManager => 0x00249f10 ServiceName => RASMAN DesiredAccess => 4 |
SUCCESS | 0x00249ee8 | |
| 09:19:47,899 | 1640 | RegQueryValueExA |
Handle => 0x00000354 DataLength => 4 ValueName => EnableAutodial Type => 852 |
FAILURE | 0x00000002 | |
| 09:19:47,899 | 1640 | NtQueryInformationFile |
FileHandle => 0x00000374 FileInformation => \x00\xc0\x03\x00\x00\x00\x00\x00\x00\xc0\x03\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:19:47,909 | 1640 | socket |
type => 1 protocol => 6 af => 2 |
SUCCESS | 0x00000458 | |
| 09:19:47,909 | 1640 | ioctlsocket |
command => 2147772030 socket => 0x00000458 |
SUCCESS | 0x00000000 | |
| 09:19:47,909 | 1640 | bind |
ip => 0.0.0.0 socket => 0x00000458 port => 0 |
SUCCESS | 0x00000000 | |
| 09:19:47,909 | 1640 | NtDeviceIoControlFile |
InputBuffer => FileHandle => 0x00000458 OutputBuffer => \x01\x00\x00\x00\x01\x00\x00\x00\x0e\x00\x02\x00\x04\x1e\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:19:47,909 | 1640 | connect |
socket => 0x00000458 |
FAILURE | 4294967295 | |
| 09:19:47,909 | 520 | select |
socket => 0x00000001 |
SUCCESS | 0x00000001 | |
| 09:19:47,909 | 520 | WSARecv |
socket => 0x000003d0 |
SUCCESS | 0x00000000 | |
| 09:19:47,909 | 1640 | send |
buffer => ! socket => 0x000003d0 |
SUCCESS | 0x00000001 | |
| 09:19:50,152 | 792 | ExitThread |
ExitCode => 0 |
SUCCESS | 0x00000000 | |
| 09:20:00,517 | 520 | select |
socket => 0x00000002 |
SUCCESS | 0x00000001 | |
| 09:20:00,517 | 404 | NtDeviceIoControlFile |
InputBuffer => \x00\x00\x00\x00B<oeX\x04\x00\x00\x01\x00\x00\x00\x0e\x00\x02\x00\x00P\x17\x03
\xeb\x00\x00\x00\x00\x00\x00\x00\x00 FileHandle => 0x00000464 OutputBuffer => |
SUCCESS | 0x00000103 |